Security audit

gh-cli

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly GitHub CLI documentation, but it includes broad write, delete, admin, and credential commands that go beyond its read-oriented repository-analysis description.

Review before installing. Use this only if you want a broad GitHub CLI reference available to the agent, not just read-only repository analysis. Prefer a GitHub token with minimal read-only scopes, and require explicit human confirmation before any write, delete, admin, auth-token, secret, key, alias, extension, workflow-run, or generic gh api mutation command is used.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (41)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a remote analysis/discovery tool, but it documents `gh pr revert`, which can modify a repository by creating a revert PR or commit workflow. That scope expansion increases the chance an agent or user will invoke a write-capable operation under the assumption the skill is read-only, creating unintended repository changes.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documented `gh skill install <skill>` capability allows the agent environment to be extended by fetching and installing additional skills, which goes beyond the stated GitHub repository analysis/discovery purpose. This can undermine trust boundaries by enabling unreviewed capability expansion from within a seemingly narrow skill.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The references section broadens the skill from remote repository analysis into general GitHub operations such as pull requests, issues, actions, releases, setup, and extensions. This mismatch can cause an agent to assume broader operational authority than intended, increasing the risk of write actions, credential changes, or workflow manipulation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is described as being for remote repository analysis, file fetching, and discovery, but the included documentation exposes active mutation capabilities such as triggering GitHub Actions workflows. In an agent setting, this expands the skill from read-oriented analysis into write-side execution on remote infrastructure, creating risk of unintended code execution, CI abuse, spend consumption, or triggering privileged workflows in target repositories.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: Administrative workflow modification operations like enabling workflows are inconsistent with an analysis-focused skill and can alter repository automation state. In practice, such capabilities could re-activate sensitive workflows, change operational posture, or enable later triggering of pipelines that perform privileged actions.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: Artifact download is broader than the stated repository-analysis scope because workflow artifacts may contain build outputs, logs, secrets-adjacent data, or unpublished internal materials not equivalent to normal repository files. In an agent context, this widens access from source analysis to CI-produced data extraction, which can increase data exposure risk.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The combination of enable, disable, run, rerun, cancel, and delete capabilities gives the skill the ability to materially manipulate CI/CD state despite being presented as a repository-analysis tool. This mismatch is dangerous because an agent may be entrusted with broad GitHub access under the assumption of read-oriented behavior, enabling disruption, evidence deletion, workflow tampering, or invocation of privileged automation.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file documents capabilities far beyond the skill's stated purpose of remote repository analysis and file fetching, including destructive issue operations, project edits, and shell-capable aliases. In an agent setting, exposing unjustified mutating and shell-evaluated commands increases the chance of misuse, prompt-influenced unsafe action, or privilege abuse against GitHub resources and the local execution environment.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented alias feature explicitly supports shell evaluation via `!` or `--shell`, causing alias expansions to be executed through `sh`. For a repository-analysis skill, this creates an unnecessary arbitrary command execution path that could be abused to run local shell commands, chain pipelines, or exfiltrate data if an agent is induced to create or invoke such aliases.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation includes `gh auth status --show-token`, which displays authentication tokens in plaintext or JSON. That capability is not needed for repository analysis and creates a direct credential exposure risk through terminal output, logs, transcripts, or downstream tool capture.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The skill includes numerous mutating issue and project management commands despite being described as analysis-focused. This mismatch broadens the agent's authority to modify or delete GitHub data, making accidental or adversarially induced repository changes more likely and more damaging in context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The documented command set substantially exceeds the skill's declared purpose of remote repository analysis and includes broad account, codespace, key, secret, cache, and gist management capabilities. This violates least privilege and creates an unnecessary expansion from read-oriented analysis into authenticated administrative and mutating operations that could be abused by an agent or prompt injection to alter remote state or access sensitive account resources.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This section documents direct access to authentication material via environment variables and includes a command that can output the active authentication token. In a skill intended for repository analysis, exposing credential-handling and token-retrieval capabilities materially increases the risk of credential disclosure, lateral movement, and unauthorized GitHub API access if the agent is induced to reveal or misuse them.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file includes numerous state-changing operations unrelated to read-only analysis, including setting and deleting secrets and variables, managing caches, modifying gists, editing codespaces, and adding or deleting SSH/GPG keys. In the context of a repository-analysis skill, these capabilities are dangerous because they enable remote tampering, persistence, credential planting, configuration changes, and destructive actions against GitHub resources.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file documents numerous state-changing GitHub CLI operations such as merging PRs, deleting projects/items/fields, editing PRs, locking conversations, and rerunning CI, even though the skill metadata says it is for remote repository analysis, file fetching, comparison, and discovery. In an agent setting, exposing undocumented or unjustified mutation paths expands the action surface from read-only analysis to write/destructive operations, increasing the risk of repository tampering or administrative misuse.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Project administration and mutation features are not justified by a repository-analysis skill and can alter planning data, metadata, and collaboration state across user or organization projects. Because GitHub Projects often span multiple repos and teams, these commands broaden blast radius beyond the repository under analysis and create opportunities for unauthorized workflow disruption or data loss.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Agent-task creation is outside the declared analysis/discovery scope and enables the skill to initiate new automated work rather than only inspect existing repository state. In an agent ecosystem, task creation can trigger downstream actions, consume resources, or create misleading automation artifacts that the user did not intend.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: The documented CI triage loop includes rerunning workflow jobs, which changes repository execution state and can consume CI resources despite the skill being positioned as analysis-only. In shared or protected repositories, unauthorized reruns may interfere with audit expectations, mask flaky failures, or trigger sensitive workflows again.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is described as supporting remote repository analysis, file fetching, codebase comparison, and discovery, but this file documents release mutation and deletion capabilities such as delete, upload, delete-asset, and edit. That creates a clear scope mismatch: an agent using this skill could be induced to perform write or destructive actions against GitHub releases when the declared purpose implies primarily read-only analysis, increasing the risk of unintended repository tampering.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: `gh release delete` enables permanent removal of a release, which is a destructive operation unrelated to the stated analysis/fetching/comparison/discovery purpose. In an agent context, exposing this command without strict scope boundaries can let prompt injection or user confusion trigger irreversible deletion of release artifacts and metadata.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: `gh release upload` introduces write capability that can modify project releases by adding new assets, despite the skill being positioned for analysis and retrieval. An attacker who can influence agent behavior could abuse this to publish misleading or malicious binaries, overwrite expectations around release contents, or otherwise alter repository distribution artifacts.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: `gh release delete-asset` permits destructive removal of release files, which is not justified by the skill's declared read-focused purpose. In the hands of an agent, this can silently break software distribution, remove evidence, or disrupt downstream consumers relying on release assets.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: `gh release edit` allows modifying release state and metadata, including publishing drafts and changing notes, which exceeds the skill's stated analytical role. This can be abused to alter official project communications or prematurely publish releases, causing integrity and operational issues.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documentation exposes a broad set of state-changing GitHub capabilities—repository deletion, renaming, forking, editing, release creation, deploy key management, issue/project mutation, and more—despite the skill being described as analysis-focused. In an agentic setting, this scope mismatch is dangerous because an LLM or tool orchestrator may invoke destructive or privilege-sensitive commands that exceed user expectations and violate least privilege.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: `gh api` provides generic authenticated access to GitHub REST and GraphQL endpoints, which is far broader than repository analysis and can be used to read or modify nearly any resource permitted by the token. In practice this becomes a privilege-escalation primitive for the skill, bypassing narrower command-level restrictions and enabling arbitrary operations against repos, orgs, issues, secrets-adjacent metadata, and administrative settings.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.