ClawHub
Back to skill

Security audit

合并检查工具(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only guide for analyzing a single GitHub PR’s merge likelihood, with authenticated GitHub access disclosed later in the instructions and no bundled executable payload.

Install only if you are comfortable letting the agent use your authenticated gh CLI session to read the target PR, related comments, reviews, checks, repository metadata, and author history. Use it only on repositories you are authorized to inspect, especially for private repos.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill invokes gh CLI to retrieve repository and PR data, but the upfront description does not clearly warn that authenticated GitHub access may be used and that private-repository metadata could be accessed under the caller's token. In an agent context with exec/write tools enabled, incomplete disclosure increases the risk of users triggering sensitive data access without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

L040 says the free version focuses on single-PR core-dimension analysis, but later documentation shows output fields and analysis dimensions that extend beyond the PR itself, including author history and social signals. This is an intent-level contradiction because the scope is described as narrowly centered on one PR while the documented behavior analyzes external historical context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L096-L099 将触发条件描述为“需要数据分析、报表生成、统计洞察、数据可视化时使用”，这是非常通用的表述，与该技能实际聚焦的“PR 合并性预测”范围不一致。缺少明确的限定触发短语、上下文约束或反例，可能导致代理在大量无关的数据分析场景中错误调用该技能。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

文件的显示名、摘要、描述及后续使用说明均固定为中文，没有提供用户可选择的语言选项，也未说明该技能仅面向中文用户或特定区域。根据语言/locale policy，这种默认强制单一语言而无用户选择可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

L317 states that no additional API key is required, while L318 immediately describes OAuth authentication and local token storage for gh CLI. Although this may distinguish between the skill's own API key and GitHub credentials, the wording is misleading because the skill does require authenticated credentials to function against many repositories.

Content

No source excerpt is available for this finding.