github-pr-automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

This skill is mostly transparent about automating GitHub PR work, but it also sets up recurring account activity and gives broad cleanup instructions without enough user control.

Install only if you are comfortable with an agent using your GitHub identity to fork, push, and create PRs. Do not enable the cron step unless you explicitly want recurring automated activity, know how to inspect and remove it, and have limited the GitHub token permissions. Run contributions in a dedicated workspace so cleanup cannot remove unrelated local work.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:115

Finding

Persistent Autonomous GitHub Contribution Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 115–125
Vulnerability Type: Persistent scheduled task
Risk Level: High

Vulnerable Code:

bash

### Phase 5: Daily Cron Job

Set up daily contribution task:

cron add --name "Daily GitHub Contribution" \
  --schedule "0 8 * * *" \
  --timezone "Asia/Shanghai" \
  --message "Search for good first issues and contribute..." \
  --channel "qqbot"

Technical Analysis

The Skill instructs the agent to register a daily cron task that remains active after the initiating session ends. The scheduled message is broad and action-oriented rather than being limited to read-only discovery. When interpreted alongside the preceding workflow, it may cause future agent runs to search GitHub, clone repositories, modify code, push branches, create pull requests, and send output through QQ Bot.

Cross-session scheduling is not required for the Skill's core one-time function of finding an issue and preparing or submitting a contribution. It therefore exceeds the minimum persistence necessary for that workflow. Although the scheduled task is documented rather than concealed, it can continue invoking authenticated network operations without fresh authorization for each run.

Attack Path

1. A user activates the Skill for an ordinary GitHub contribution request.
2. The agent follows Phase 5 and executes the documented cron add command.
3. A persistent daily task is registered for 08:00 in the Asia/Shanghai timezone.
4. After the original session ends, the scheduler repeatedly supplies the instruction to search for issues and contribute.
5. Future executions may use available GitHub credentials to fork or clone repositories, push branches, or create pull requests.
6. Results may also be sent through the configured qqbot channel without new per-run user approval.

Impact Assessment

The scheduled task can obtain the same effective privileges av ...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic cron-registration phase from the default contribution workflow.
2. If recurring operation is genuinely required, expose scheduling as a separate, explicit opt-in feature rather than a normal workflow step.
3. Require immediate user confirmation before registering the task, including disclosure of the schedule, timezone, destination channel, credentials used, and exact operations permitted.
4. Restrict scheduled runs to read-only issue discovery by default. Require separate interactive approval before cloning, modifying code, pushing branches, commenting, or creating pull requests.
5. Replace the open-ended scheduled message with a narrowly scoped instruction that prohibits authenticated write operations.
6. Use fine-grained, repository-specific GitHub credentials with only the permissions required for the approved task instead of broadly scoped repo access.
7. Provide commands to inspect, disable, and permanently remove the scheduled task.
8. Add expiration and run-count limits so any approved schedule automatically terminates after a short, user-defined period.
9. Log every scheduled execution and notify the user before any external write or messaging action.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to set up a daily cron job that performs ongoing actions against external services and repositories, but it does not clearly warn the user that automation will continue running after the immediate session. In the context of GitHub contributions, this can cause repeated unsolicited actions, consume account tokens, and create reputational or policy risks for the user's external account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to 'Always clean up local files after contribution' is underspecified and lacks any warning that cleanup operations may remove repositories, branches, or user work from the local machine. In this skill's context, cleanup is likely to involve file deletion in cloned repositories, so an agent could remove uncommitted changes or nearby user data if paths are handled incorrectly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction 'Draft a comment for the issue (in English)' imposes a language choice as a default requirement. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.