Gh Fix Ci

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 3:03 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed GitHub Actions troubleshooting helper that reads PR checks and logs, then requires user approval before making fixes.

Install this only if you are comfortable letting an agent use your existing GitHub CLI login to read PR check status and GitHub Actions logs. Review any proposed code changes before approving them, especially in repositories where CI logs may contain sensitive internal details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute multiple shell commands (`gh`, `python`, shell redirection) but does not declare any permissions or execution constraints. That mismatch is a real security issue because it can cause the agent framework to run repository- and network-affecting commands without explicit user-visible authorization boundaries, especially when handling untrusted PR metadata, URLs, and logs.

VirusTotal

65/65 vendors flagged this skill as clean.