ClawHub
Back to skill

Security audit

GitHub开发工具

Security checks across malware telemetry and agentic risk

Overview

This GitHub skill is not overtly malicious, but it grants broad command and repository-management powers with vague scope and weak safety guarantees.

Install only if you are comfortable letting the agent use your authenticated GitHub authority through gh. Keep it to explicit GitHub tasks, review proposed commands before they run, avoid exposing tokens or private repository data in logs, and prefer a least-privileged GitHub token or account where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill asserts that only whitelisted commands are executed and that user input is not concatenated, yet the document exposes generic exec capability and provides no concrete whitelist, validation, or enforcement mechanism. This creates a misleading safety claim that could cause operators or downstream agents to trust dangerous command execution paths that may accept attacker-controlled input.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill claims outputs will not contain sensitive data, but its documented output format includes execution logs and command/API results that can easily contain tokens, repository secrets, private issue contents, or other sensitive responses. This mismatch can lead to accidental disclosure through logs, agent transcripts, or stored artifacts.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation language is extremely broad, covering code generation, debugging, deployment, and general development assistance, which increases the chance the skill is invoked in contexts far beyond narrowly scoped GitHub tasks. Because the skill includes exec, write, and GitHub API capabilities, overbroad triggering can cause high-impact actions to be taken in situations where the user did not intend to authorize repository changes or command execution.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill advertises GitHub management, API calls, file writes, and command execution without prominent user-facing warnings or confirmation requirements for impactful operations. In this context, the combination of repository mutation, local command execution, and external API interaction makes accidental or malicious misuse more dangerous, especially if an agent auto-selects the skill based on broad prompts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.