Security audit

github-repos

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a GitHub management helper, but it needs Review because it can change repositories and also advertises broader file and command automation without strong upfront boundaries.

Review this before installing if the connected GitHub account has write permissions. Use least-privilege GitHub access, preview and explicitly confirm every write operation, and avoid treating this as a general local file or shell automation skill unless the task is directly tied to GitHub repository work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Low

Confidence: 79% confidence
Finding: The skill explicitly discusses write-capable GitHub actions and even says writes should always be confirmed, but its usage examples show direct state-changing operations without embedding that safeguard into the main workflow guidance. In an agent setting, this mismatch can lead to unintended issue, PR, label, branch, or release modifications if the agent or user assumes the examples are safe to execute as-is.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill is presented as a GitHub repository management integration, but later claims generic file-processing, API integration, and command-execution abilities that materially broaden the apparent authority of the skill. This can mislead an agent into invoking local file or shell behaviors outside the intended GitHub scope, increasing the chance of unsafe execution or overprivileged use.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The quantitative assessment advertises broad local file parsing, batch file handling, and command execution performance characteristics that do not match a narrowly scoped GitHub skill. Overstating these capabilities can cause an agent to treat the skill as a general-purpose automation primitive, which increases the risk of inappropriate local actions and privilege misuse.

Vague Triggers

Medium

Confidence: 71% confidence
Finding: The activation guidance is broad and encourages use whenever efficiency, automation, batch processing, or workflow optimization is desired, rather than narrowly scoping when this GitHub skill is appropriate. In agent routing, overbroad invocation criteria can cause the skill to be selected for tasks outside its safe or intended domain.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The markdown introduces repository-management operations that can change remote state without a clear upfront warning that some actions are destructive or write-capable. In practice, users and agents may proceed from examples directly to modifying repository data, labels, issues, branches, or pull requests without understanding the need for confirmation and least-privilege handling.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.