Security audit

gh-cli

Security checks across malware telemetry and agentic risk

Overview

This GitHub CLI skill is mostly documentation, but it includes commands that can mutate GitHub resources, expose tokens, and change local credential or SSH configuration beyond its stated analysis purpose.

Install only if you want an agent to have broad GitHub CLI knowledge, not just read-only repository analysis. Use read-only or narrowly scoped GitHub tokens where possible, avoid token-display commands, and require explicit human approval before any command that changes GitHub state, installs skills/extensions, modifies credentials, or touches SSH/GPG/Codespaces configuration.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (41)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill is described as a remote analysis and discovery tool, but it documents `gh pr revert`, which performs a state-changing repository action. In an agent setting, exposing destructive commands outside the declared scope increases the chance that a user request or prompt confusion leads to unauthorized modification of a repository rather than read-only analysis.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The manifest advertises a narrow analysis/discovery purpose, but the references section points to broader operational workflows such as issues, releases, and Actions, which commonly include write or administrative operations. This scope expansion is dangerous because it can cause an agent or operator to treat the skill as safe for read-only use while it actually enables broader and potentially sensitive repository actions.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Documenting `gh skill install` introduces capability to fetch and install additional skills, which expands execution surface beyond the stated repository analysis purpose. In an agent environment this is risky because it can bootstrap new, unreviewed functionality and bypass the principle of least privilege through indirect capability escalation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is described as analysis-focused, but the referenced actions include `gh workflow run`, which can remotely trigger GitHub Actions and cause side effects in a target repository. In an agent setting, exposing mutating commands that exceed the advertised scope increases the risk of unauthorized workflow execution, resource consumption, secret exposure through workflows, or unintended repository changes.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This section documents workflow enablement and adjacent run-management operations that modify remote repository state, which is inconsistent with an analysis-only skill. In an agent context, such capabilities can be invoked through prompt misuse or operator misunderstanding to activate disabled workflows or otherwise alter CI/CD behavior on repositories the token can access.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file includes remote cancellation, deletion, and administrative Actions controls (`gh run cancel`, `gh run delete`, workflow enable/disable), which are unjustified for a repository analysis skill and create direct destructive capability. If an agent or user misuses these commands, they can disrupt CI pipelines, erase run history, and change workflow availability across repositories accessible to the configured credentials.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The referenced command enables Git credential-helper configuration, which goes beyond the skill's stated purpose of read-only GitHub repository analysis. In an agent context, exposing authentication and credential plumbing increases the chance of unintended credential use, persistence, or scope expansion, especially if the skill is invoked in environments with existing GitHub authentication.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Credential-helper setup is not justified for a repository-analysis skill and represents unnecessary capability exposure. Even if presented as documentation only, including it in the skill broadens the operational envelope toward credentialed write-capable workflows, making misuse or accidental privilege escalation more likely in an automated agent setting.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This section documents capabilities that go beyond passive repository analysis, including issue/comment/project mutations and shell-capable alias expansion. In the context of a skill advertised for remote repository analysis, file fetching, comparison, and discovery, exposing write and execution-oriented commands creates an unnecessary privilege surface that could be abused to alter GitHub state or trigger local shell execution.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The alias feature explicitly supports shell evaluation via `!` or `--shell`, which enables arbitrary command execution through `sh`. That is not justified by a repository-analysis skill and materially increases the risk of command injection, local execution, and abuse if an agent or user is induced to create or invoke such aliases.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The `gh auth status --show-token` behavior can print authentication tokens in plaintext, including in JSON output. For a skill intended for repository analysis, credential disclosure is unnecessary and dangerous because exposed tokens can be harvested from logs, transcripts, or downstream tooling and then used for unauthorized GitHub access.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: Across the file, the documented commands include deleting issues, locking/unlocking, commenting, reopening/closing issues, editing labels, and editing project items. These are remote state-changing operations inconsistent with the stated read-oriented manifest, so the skill context makes them more dangerous by creating surprising write capabilities that an agent may misuse without explicit authorization.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documented capability surface of this skill substantially exceeds its stated purpose of read-oriented remote repository analysis. It includes authentication management, token output, secret/variable mutation, SSH/key operations, codespace control, and delete actions, enabling credential access and state-changing operations that are unnecessary for passive analysis and increase the blast radius if the skill is invoked by an agent.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The presence of `gh auth token` exposes a direct mechanism to print authentication tokens, which can then be exfiltrated or reused to access GitHub resources. This is especially dangerous in an agent context because a tool intended for repository analysis should not have credential-retrieval capability at all.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Secret and variable mutation commands permit modification of repository, organization, or user configuration unrelated to repository analysis. In an agent workflow, these operations could be abused to plant credentials, alter CI/CD behavior, change deployment configuration, or disrupt projects.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: SSH, GPG, and account key-management features are not justified for remote repository analysis and expand access into identity and trust configuration. Misuse could add attacker-controlled keys, remove legitimate keys, or alter trusted signing material, enabling persistence or account compromise.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Codespace management and local/remote file transfer capabilities permit interaction with remote execution environments and movement of files between local and remote systems. That exceeds a read-only analysis use case and creates opportunities for data exfiltration, unauthorized environment access, and unintended state changes.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is described as read-oriented repository analysis/fetch/compare/discovery, but this section documents `gh pr merge`, a state-changing operation that can directly modify repository history and governance state. In an agent setting, exposing merge capability beyond the declared scope increases the chance of unauthorized or accidental repository mutation, especially because the command can select the current branch's PR implicitly and even bypass merge-queue controls with `--admin`.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: These project commands expose broad mutation capability such as creating, editing, and otherwise modifying GitHub Projects, which is inconsistent with the manifest's analysis-only positioning. The mismatch is dangerous because users or downstream agents may trust the skill as read-only while it actually enables write operations against organizational planning assets and metadata.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Preview `gh agent-task` capabilities are outside the stated purpose of repository analysis and code discovery, and preview features are explicitly unstable. Including them broadens the action surface into task creation and interaction patterns that may trigger side effects or future behavior changes not anticipated by users relying on an analysis-oriented skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The guidance recommends `gh run rerun`, which changes CI execution state and can consume compute, alter audit trails, and retrigger sensitive workflows. That is not justified by an analysis-only skill and may be especially risky in repositories with privileged CI contexts, deployment hooks, or billing-sensitive runners.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is described as read-oriented repository analysis and discovery, but this reference includes write/destructive release-management commands such as delete, upload, edit, and delete-asset. This creates a capability/intent mismatch that can enable unauthorized modification or deletion of repository release artifacts if the skill is invoked with credentials.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Release deletion is a destructive capability unrelated to the stated use case of remote repository analysis and discovery. In an agent context, exposing `gh release delete` under an analysis-branded skill increases the risk of accidental or induced destructive actions against production release history.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Asset upload allows modifying release contents, which exceeds a read-only analysis/discovery scope. An attacker or confused agent could use this capability to publish unreviewed or malicious binaries/assets under trusted project releases.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Asset deletion is a destructive repository-modification capability that is not justified by repository analysis or discovery. In practice, it could remove distributed artifacts, disrupt users, and tamper with release contents.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.