Security audit

GitHub订阅

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a GitHub Trending helper, but its documentation asks for broad execution/write authority and describes unrelated or privileged capabilities without clear implementation or boundaries.

Review this skill carefully before installing. It may be suitable only as documentation for fetching public GitHub Trending data, but do not grant broad exec/write access, API keys, or private repository permissions unless the publisher supplies a concrete implementation, exact commands, and clear permission boundaries.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is presented as a GitHub Trending feed, but the documentation advertises unrelated capabilities such as static analysis, dependency vulnerability detection, CI/CD integration, and bulk code review. This scope inflation can mislead an agent or operator into granting broader trust, permissions, or usage patterns than the actual skill requires, increasing the chance of unsafe invocation or misuse.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Claiming support for private repositories contradicts the stated Trending-feed behavior and suggests access to sensitive repository data that should be out of scope. Even if unimplemented, this can cause users or agents to assume the skill is appropriate for privileged repository access, leading to accidental data exposure or over-privileging.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation text is overly broad, suggesting use for general efficiency improvement, automation, batch processing, and workflow optimization rather than only GitHub Trending retrieval. Overbroad trigger language can cause agents to invoke the skill in unrelated contexts where its exec/write capabilities are unnecessary, expanding attack surface and enabling prompt-scope abuse.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation examples are incomplete and ambiguous, including placeholder text instead of a concrete script path or command. Ambiguous invocation guidance increases the risk that an agent or user improvises execution behavior, potentially running the wrong file, unsafe local commands, or unintended scripts in a privileged environment.

Static analysis

No suspicious patterns detected.