Read Github Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a repository-reading helper, but it asks for broad local execution/write authority and has under-scoped network behaviors that users should review before installing.

Install only if you are comfortable with the agent contacting gitmcp.io and possibly third-party URLs while processing repository content. Prefer running it in a restricted environment, avoid using callback_url unless you trust the destination, and do not grant write or unrestricted command execution unless the publisher provides a clear audited implementation that needs those permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:32

Finding

Excessive Execution and File-Write Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-35
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill declares unrestricted exec and write capabilities even though its stated purpose is to retrieve and search repository documentation through a remote MCP service. Local file modification is not required for those operations, and the package contains only SKILL.md; it does not include the local scripts repeatedly referenced by its command examples.

Granting capabilities beyond the minimum required increases the consequences of processing untrusted repository documentation or external content. If an Agent interprets malicious content as instructions, the exposed execution and write tools could provide a path from content processing to local command execution or file modification.

This finding does not establish that the Skill itself contains a malicious command. It identifies an unnecessary privilege boundary that could be exploited in combination with attacker-controlled content or unsafe Agent behavior.

Attack Path

1. An Agent loads the Skill and grants the declared read, exec, and write tools.
2. A user requests content from a repository or external URL controlled by an attacker.
3. The retrieved content contains instructions designed to influence the Agent into invoking local tools.
4. Because the Skill has declared execution and write access, the Agent may execute commands or create and modify local files if it fails to isolate retrieved content from trusted instructions.
5. The resulting access is limited by the operating-system privileges of the Agent process but may affect all files and commands available to that process.

Impact Assessment

Successful exploitation could permit arbitrary command execution and l ...[truncated 366 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the write capability because the documented repository-reading workflow does not require local file modification.
2. Replace unrestricted exec access with a narrowly scoped MCP or HTTP client tool that only permits the documented operations.
3. Restrict outbound requests to approved HTTPS endpoints, including the expected gitmcp.io host.
4. Treat all repository documents, source code, and externally fetched content as untrusted data rather than executable Agent instructions.
5. Require explicit user confirmation before any local command execution.
6. If local execution is genuinely required, provide the exact audited script in the package and constrain its accepted commands and arguments.
7. Run the Skill in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted network connectivity.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:389

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 389
Vulnerability Type: Unpinned dependency installation from an unspecified package source
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The setup guidance recommends installing requests without pinning a version, verifying package hashes, or specifying an approved package index. Consequently, the installed package and its transitive dependency set can change over time and may vary according to the user's configured Python package source.

Although requests is a well-known package and the installation is described as optional, the instruction creates a supply-chain exposure. A compromised release, compromised package index, maliciously configured mirror, or future incompatible dependency could introduce unreviewed code into the Agent environment. Python packages and installation tooling may execute package-controlled code during installation or later import and use.

The audit found no evidence that the named package is currently malicious. The issue is the non-reproducible and unverified installation method.

Attack Path

1. A user follows the dependency setup instructions.
2. pip resolves the latest compatible requests release and transitive dependencies through the environment's configured package index or mirror.
3. An attacker compromises a resolved package release, dependency, index, or configured mirror.
4. The malicious package content is installed into the selected Python environment.
5. Package-controlled code executes during an applicable installation phase or when the package is imported and used.
6. The malicious code receives the privileges and accessible resources of the Python or Agent process.

Impact Assessment

Exploitation could result in code execution within the Python environment used by the Agent. The potential scope includes access to files, environment variables, ...[truncated 195 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and all transitive dependencies to reviewed versions.
2. Use a lock file or requirements file with cryptographic hashes, and install with hash verification enabled.
3. Specify and enforce an approved HTTPS package index rather than relying on ambient pip configuration.
4. Regularly scan pinned dependencies for known vulnerabilities and update them through a controlled review process.
5. Install dependencies in an isolated virtual environment with minimal privileges.
6. Prefer an Agent-provided, constrained network client if it eliminates the need to install an additional runtime dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation scope is overly broad and includes generic file handling, document conversion, content extraction, and URL use cases beyond repository reading. In an agent environment, this can cause the skill to be invoked in contexts involving unrelated or sensitive user files and links, increasing the chance of inappropriate tool use, data exposure, or unexpected network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Documenting callback_url support without warning that results may be sent to a remote endpoint is a real exfiltration risk. A user or downstream prompt could supply an attacker-controlled callback URL, causing repository contents, search results, or derived summaries to be transmitted off-platform without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports fetching external URLs referenced in repository docs, but it does not warn users that this causes network access to third-party sites. That omission undermines informed consent and can lead to unanticipated data transmission, contact with malicious hosts, or retrieval of unsafe content in otherwise routine repository-reading workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L084 states the free version does not support API integration, implying users should rely on MCP tool usage only. However, the example implementation later uses requests.post(...) against https://gitmcp.io, which is itself an API-style integration path rather than just declarative MCP invocation, contradicting the stated limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The keyword coverage list uses ambiguous, fragmented trigger phrases with no clear boundaries, making accidental invocation more likely. In a tool-enabled agent, vague activation logic can route unrelated prompts into a skill that performs network retrieval and code/document access, broadening exposure unnecessarily.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The example code performs an outbound POST carrying tool names and arguments to a remote service. External transmission is expected for an MCP client, but it remains security-relevant because repository identifiers, queries, and possibly fetched content may leave the local environment; combined with the skill's broad scope and weak warnings, this becomes more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

"tool": tool_name, "args": args } response = requests.post(url, json=payload, timeout=self.timeout) return response.json()

text

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill advertises fetching external URLs referenced in repository documentation, but the stated robots.txt respect appears only as a comment with no enforcement logic shown. This creates a risk of the agent making network requests to arbitrary third-party hosts without policy checks, which can enable unintended outbound access and retrieval of untrusted content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.