Security audit
Security checks for vulnerabilities and agentic risk
This is a mostly coherent GitHub repository management skill, with disclosed GitHub write capabilities and no hidden code or persistence, though some wording is broader than ideal.
Install only if you want an agent to operate on GitHub repositories through ClawLink. Review repository write actions before approval, especially issue creation, labeling, pull requests, branch/tag operations, and any gateway configuration changes. Avoid using this skill as a general local file or shell automation tool.
The activation guidance is overly broad ('提升效率、自动化流程、批量处理、工作流优化') and is not limited to concrete GitHub repository tasks. This can cause the skill to be selected for general automation requests, increasing the odds that powerful read/write/exec capabilities are used outside their intended context and without adequate scrutiny.
The examples demonstrate write-capable GitHub actions such as creating issues, adding labels, and creating pull requests, but they do not place a prominent warning before the examples that these operations modify remote repository state. In agent-driven contexts, examples often become executable patterns, so this raises the risk of accidental or insufficiently reviewed changes to production repositories.
The skill claims broad file read/parse/write support that is not necessary for a GitHub-focused integration skill. That mismatch can cause an agent to treat the skill as a general local file manipulation tool, enabling unintended access to workspace contents or writes to unrelated files under the guise of repository management.
The skill advertises generic system command execution ('在安全沙箱中执行系统命令并收集结果') even though its declared purpose is GitHub repository management. This broadens the operational scope from repository actions to arbitrary shell behavior, increasing the chance that a user or downstream agent invokes unrelated commands that could access local data, modify files, or run unsafe workflows.
No suspicious patterns detected.
