Security audit

仓库归档搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an issue/PR archive search helper, but its instructions broaden into unrelated development and analytics tasks while allowing command execution and local writes.

Install only if you want an agent to run gitcrawl/gh commands and maintain a local GitHub issue/PR archive. Keep GitHub token permissions narrow, expect data to be stored under your home directory, and avoid using this skill for general coding, analytics, reporting, or deployment tasks unless the publisher narrows the instructions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest and top-level description present the skill as a lightweight repository archive search tool, but the invocation guidance expands to broad development tasks like code generation, debugging, testing, and deployment. This scope inflation can cause an agent to invoke the skill in contexts far beyond its actual purpose, increasing the chance of unnecessary command execution and misuse of granted tools.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The 'core functions' section reframes the skill as a general automation, file-processing, API-integration, and command-execution tool. In combination with exec/read/write permissions, this misleading broadening makes the skill more dangerous because it encourages invocation outside the narrow archive-search use case and normalizes powerful operations without tight boundaries.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger condition says to use the skill for broad needs such as data analysis, report generation, statistical insights, and visualization, which far exceeds the declared repository archive search purpose. Overly broad invocation criteria are dangerous because they can route unrelated user requests into a skill with exec/write capability, increasing the risk of unnecessary filesystem changes, network access, and command execution.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The description includes broad invocation guidance covering code generation, programming assistance, debugging, testing, and deployment. That overlap with common development requests can cause the agent to select this skill too often, exposing exec/write capabilities in situations unrelated to repository archive search.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes local cache creation, querying, and export operations without prominent warnings or constraints around local writes. Because the skill has write capability and encourages archive initialization and sync to local storage, users and agents may perform persistent filesystem changes without clear notice, path restrictions, or consent expectations.

Static analysis

No suspicious patterns detected.