Actor Identifier

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

The skill is a repository analytics helper, but its documentation gives conflicting safety promises while also showing CI workflows that write reports, push commits, and notify Slack.

Install only after reviewing the CI and publishing sections carefully. Use local read-only Git analysis by default, and enable report commits, pushes, Slack notifications, sudo package installs, or custom metric query execution only with explicit scoped credentials and least-privilege CI permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:187

Finding

Generated repository reports are pushed over the network despite local-only security claims

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:187-199
Vulnerability Type: Undisclosed network transmission and repository modification
Risk Level: High

The documented CI workflow commits generated analysis reports and pushes them to the configured Git remote. It then invokes an external Slack action:

yaml

    - name: 提交报告到文档库
      run: |
        git config user.name "Analysis Bot"
email "[e-mail]"
        git add reports/
        git commit -m "chore: weekly repo analysis report [skip ci]" || true
        git push
# ...
    - name: 通知团队
      uses: slackapi/slack-github-action@v1
      with:
        slack-message: "本周仓库协作分析报告已生成,详见 reports/repo-analysis/"

This behavior conflicts with the declarations at SKILL.md:351 and SKILL.md:412 that processing involves no network, no writes, and no Git remote operations.

Technical Analysis

The core repository-analysis function only requires read access to local Git metadata. The example workflow instead performs the following additional operations:

1. Writes generated analytics under reports/.
2. Creates a new Git commit.
3. Uses CI credentials to transmit that commit to a remote repository.
4. Executes a third-party Slack integration.

Generated reports may contain repository activity statistics, workflow observations, author names, file-level risk information, and other metadata derived from private commit history. Even if the destination repository is legitimate, transmitting these reports without an accurate disclosure or explicit opt-in violates the documented trust boundary.

The Slack message shown does not itself contain report contents or credentials. However, executing the external action still introduces a network operation and gives third-party action code access according to the workflow's token, secret, and workspace permissions.

Attack Path

1. A user adopts the supplied scheduled CI workflow based o ...[truncated 1398 chars]

Remediation

View remediation

Remediation Suggestions

1. Make local, read-only report generation the default behavior.
2. Place report publication and Slack notification behind separate, explicit opt-in settings.
3. Require user confirmation before adding, committing, or pushing generated files.
4. Correct the security documentation to disclose all filesystem writes, network destinations, third-party services, and required credentials.
5. Clearly document which report fields may include author names, file paths, commit-derived metadata, or other sensitive information.
6. Redact names, sensitive paths, commit-message contents, credentials, and internal identifiers before publication.
7. Configure explicit minimal GitHub Actions permissions. Grant contents: write only to the publication job and only when publication is enabled.
8. Separate analysis and publication into different jobs so the analysis job has no write token or notification secret.
9. Restrict publication to a designated branch or artifact store with appropriate retention and access controls.
10. Validate the destination remote before pushing and protect against publishing reports from untrusted pull-request contexts.
11. Provide a fully local workflow variant that performs no package download, remote action invocation, commit, push, or notification.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:198

Finding

Mutable and unpinned third-party dependencies execute in the CI trust boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:198 and SKILL.md:340-341
Vulnerability Type: Insecure dependency pinning and supply-chain exposure
Risk Level: Medium

The workflow references a GitHub Action through a mutable major-version tag:

yaml

    - name: 通知团队
      uses: slackapi/slack-github-action@v1
      with:
        slack-message: "本周仓库协作分析报告已生成,详见 reports/repo-analysis/"

The dependency instructions also install Python packages without fixed versions or integrity hashes:

markdown

| weasyprint | Python 包 | 可选(PDF 引擎) | `pip install weasyprint` |
| PyYAML | Python 包 | 推荐(读取指标配置) | `pip install pyyaml` |

Technical Analysis

A mutable action tag such as @v1 can resolve to different code over time without a change to this Skill. Likewise, unconstrained pip install commands retrieve whichever package version currently satisfies the request.

This prevents the reviewed dependency artifact from remaining stable. If an upstream account, release process, package, or mutable reference is compromised, changed code may execute automatically in scheduled CI runs. The action executes inside the workflow trust boundary, where it may have access to the checked-out repository, generated reports, environment variables, GitHub token, and any secrets explicitly exposed to the step.

No evidence was found that the named action or Python packages are currently malicious. The vulnerability is the unsafe dependency-resolution mechanism and resulting supply-chain exposure.

Attack Path

1. The team copies the documented CI workflow or dependency installation instructions.
2. A mutable action tag is moved to changed code, or an unconstrained package release is compromised.
3. A scheduled or manually dispatched workflow resolves and downloads the changed dependency.
4. The dependency executes with the permissions and environment available to the CI step.
5. Malicious dependency code ...[truncated 783 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every GitHub Action to a reviewed full commit SHA rather than a mutable major-version tag.
2. Record the corresponding release version in a comment so maintainers can audit upgrades.
3. Pin Python dependencies to exact reviewed versions in a lock file.
4. Use package hashes, such as pip's --require-hashes, to verify downloaded artifacts.
5. Use a trusted, controlled package index or approved internal mirror where appropriate.
6. Enable automated dependency review and require manual approval for dependency updates.
7. Apply explicit least-privilege GitHub Actions permissions and set the default token permission to read-only.
8. Do not expose publication tokens or notification secrets to dependency-installation and report-generation steps.
9. Isolate PDF generation and notification in separate jobs with only the permissions each job requires.
10. Maintain an allowlist of reviewed dependencies and document their purpose and security ownership.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:208

Finding

Executable metric query design lacks the claimed command allowlist implementation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:208-238
Vulnerability Type: Potential shell command injection through configuration-defined queries
Risk Level: Medium

The custom metric format stores shell pipelines as configuration values:

yaml

# .repo-metrics.yaml — 自定义指标配置
version: "1.0.3"
metrics:
  # 仓库级提交节奏
  - name: "日均提交数"
    query: "git log --pretty=format:'%ad' --date=short | sort -u | wc -l"
    baseline: 5.0
    threshold:
      warning_below: 3.0
      critical_below: 1.0
# ...
  # 约定式合规率
  - name: "约定式提交合规率"
    query: "git log --pretty=format:'%s' | grep -cE '^(feat|fix|chore|docs|style|refactor|test|perf|ci|build)'"
    baseline: 80  # 百分比
    threshold:
      warning_below: 70
      critical_below: 50
# ...
  # 文件级巴士因子(风险文件数)
  - name: "单一作者文件数"
    query: "git log --pretty=format:'%an' --name-only | sort | uniq -c | awk '$1==1' | wc -l"
    baseline: 10
    threshold:
      warning_above: 20
      critical_above: 50
# ...
  # 大提交比例(>500行)
  - name: "大提交比例"
    query: "git log --pretty=format:'%H' --shortstat | grep -E '([5-9][0-9]{2}|[0-9]{4,}) insertion' | wc -l"
    baseline: 0.1  # 10%
    threshold:
      warning_above: 0.2
      critical_above: 0.4

At SKILL.md:368, the document claims that CI validates each query against a read-only allowlist. At SKILL.md:406, it again claims that only allowlisted read-only Git subcommands are permitted. However, the audited project contains only SKILL.md; it does not include the referenced execution script, parser, validator, or allowlist implementation.

Technical Analysis

A configuration field containing an entire shell pipeline is an unsafe command-execution interface. If downstream automation runs the value through sh -c, bash -c, eval, or an equivalent shell API, anyone able to modify .repo-metrics.yaml can potentially append shell metacharacters, command substitutions, re ...[truncated 2286 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove free-form shell command strings from .repo-metrics.yaml.
2. Replace query with a fixed metric identifier, such as daily_commit_count, mapped to reviewed implementation code.
3. Execute Git directly through an argument-array API without invoking a shell.
4. Implement post-processing in a trusted programming language rather than accepting pipes to grep, awk, sort, and wc.
5. If configurable arguments are required, validate each argument against a strict schema and reject unknown options.
6. Reject shell metacharacters, substitutions, redirects, control operators, newlines, and environment expansion. Do not rely on this rejection alone if a shell remains involved.
7. Supply the promised validator and allowlist in the Skill package before claiming that the control is enforced.
8. Add tests covering command separators, substitutions, nested quoting, newline injection, redirects, and malformed YAML.
9. Treat configuration changes from pull requests as untrusted and do not expose write tokens or secrets while evaluating them.
10. Run metric analysis in a restricted environment with a read-only checkout, no repository write token, no unnecessary secrets, and denied outbound network access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill chains checkout of full repository history, privileged package installation, script execution, PDF generation, git commit/push, and Slack notification in one automated flow. This creates a high-risk execution chain where repository data can move from local analysis into persisted artifacts and external services with little separation or consent checkpoints.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

fetch-depth: 0
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly claims it is local, read-only, and performs no writes, but elsewhere documents report generation, archival, git commit/push, and Slack notification flows. This mismatch can mislead users and downstream agents into granting broader file-system and network actions than expected, undermining informed consent and security policy enforcement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The security contract promises only read-only git commands and no network activity, yet the documented workflow includes git commit/push and Slack integration. Such contradictory guarantees create a trust boundary failure: operators may allow the skill under a low-risk policy while it actually enables repository mutation and external data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation language is broad enough to match generic analysis, reporting, visualization, and automation requests outside the narrow repo-analysis purpose. Overbroad matching can cause accidental skill activation, increasing the chance that an agent invokes exec-capable behavior in contexts where the user did not intend to authorize repository inspection or automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states '支持中文交互' and the document consistently presents the skill as Chinese-interaction oriented, but it does not offer language selection or indicate that Chinese is optional. This can violate language/locale policy expectations when users have not opted into a Chinese-only interaction mode.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The highlighted core feature says the skill provides '中文交互', again framing a specific language mode as part of the default behavior. There is no accompanying note that users may choose another language, so the file presents a fixed locale preference without opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documented workflow instructs use of sudo in CI to install packages. Elevated execution increases blast radius if the workflow, package source, or surrounding job is compromised, and normalizes privileged operations in an exec-capable skill.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Installing packages with sudo as part of a copied workflow introduces privileged system modification in an environment that users may not expect to require elevated access. This broadens the consequences of workflow tampering or dependency abuse and is unnecessary for many analysis tasks.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

- name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
        run: |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The CI/CD and Slack examples perform outbound network actions and repository publishing but do not place a clear warning immediately adjacent to those examples. Users may copy these workflows expecting local-only analysis and unintentionally transmit internal repository-derived data to external services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The API Key section states the core skill is based on local git commands and '无需额外 API Key' except for Slack/private repo push scenarios (L344-L347). But the FAQ answer at L458-L459 broadly says '是的，部分功能需要配置对应平台的API Key,' which overstates the requirement and conflicts with the earlier intent that the main analysis capability is local and keyless. This creates misleading documentation about the skill's operational dependencies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documentation describes report creation and archival behavior without an upfront warning that files will be created in the workspace. While lower risk than network exfiltration, implicit writes can still violate user expectations or policy in supposedly read-only analysis environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.