ClawHub
Back to skill

Security audit

Repo Manager Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for GitHub repository management, but it asks users to install and allowlist an unverified plugin with broad GitHub OAuth authority.

Review before installing. Only use this if you trust the repo-manager-plugin source, can verify the package identity, and are comfortable granting GitHub repository access. Avoid granting the workflow scope unless you specifically need workflow-related features, and prefer the narrowest GitHub permissions available.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:301
Finding

Unverified Executable Plugin Is Installed and Added to the Agent Allowlist

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 301-309
Vulnerability Type: Unverified third-party executable dependency
Risk Level: High

Vulnerable Code

bash
# Install the repository management plugin
agent plugins install repo-manager-plugin

# Configure tool permissions
agent config set tools.alsoAllow '["repo-manager-plugin"]' --strict-json

# Restart the Agent session
agent restart

The dependency table at lines 427-433 also identifies repo-manager-plugin as a mandatory integration plugin without providing a publisher, trusted registry, pinned version, integrity digest, signature, or source repository.

Technical Analysis

The Skill instructs users to install an executable third-party plugin, explicitly add it to the Agent tool allowlist, and restart the Agent so that the plugin is loaded. The dependency is identified only by a mutable package name.

No plugin implementation is included in the audited project, so its credential handling and runtime behavior cannot be verified. The document also states that this plugin manages GitHub OAuth credentials and performs authenticated GitHub API operations. Consequently, compromise, substitution, dependency confusion, or typosquatting involving the named package could place attacker-controlled code inside a trusted execution boundary.

Installing the plugin is necessary for the declared MCP-based functionality, but trusting an unpinned and unverifiable package exceeds the minimum safe dependency posture.

Attack Path

  1. An attacker publishes, replaces, or compromises a package distributed under the expected plugin name or through the registry resolved by the installation command.
  2. A user follows the Skill instructions and runs agent plugins install repo-manager-plugin.
  3. The user explicitly adds the installed plugin to the Agent allowlist.
  4. Restarting the Agent loads the compromised plugin into the trusted tool environm ...[truncated 1114 chars]
Remediation
View remediation

Remediation Suggestions

  1. Identify the official plugin publisher and the trusted registry from which the package must be installed.
  2. Pin the dependency to an immutable version and, where supported, an integrity digest.
  3. Require package signature or checksum verification before installation.
  4. Link to an auditable source repository and publish reproducible build information.
  5. Provide a permission manifest documenting all filesystem, process, network, credential, and GitHub access required by the plugin.
  6. Avoid adding a package to the Agent allowlist until its identity and integrity have been verified.
  7. Run the plugin in a sandbox with restricted filesystem access, a narrow network allowlist, and no access to unrelated Agent credentials.
  8. Separate read-only and write-capable plugin configurations so users do not grant modification privileges for read-only tasks.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:438
Finding

OAuth Guidance Recommends an Unsupported and Unnecessary Workflow Scope

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 438-442; related limitation at lines 415-419
Vulnerability Type: Excessive OAuth authorization scope
Risk Level: Medium

Vulnerable Documentation

Faithful English rendering of the relevant lines:

text
- OAuth authentication: Complete GitHub OAuth authorization through the integration panel; the plugin securely stores the token.
- No manual token configuration required: The plugin automatically manages token acquisition and refresh.
- Token storage: Encrypted at ~/.repo-manager/credentials.enc
- Permission scope: Determined by the authorization scope; including repo and workflow is recommended.
- Prohibited: Hard-coding any token in SKILL.md or scripts.

The documented free-edition limitations state:

text
- Workflow management is not supported, including tools related to GitHub Actions.

Technical Analysis

The Skill recommends including GitHub's workflow OAuth scope even though it explicitly states that the free edition does not support workflow or GitHub Actions management. Authorization to modify workflow files is therefore unrelated to the declared functionality of this edition.

This violates least privilege by granting the integration authority beyond what its supported repository, issue, pull request, commit, and branch operations require. The unnecessary scope also increases the consequences of plugin compromise, OAuth token theft, or accidental tool misuse.

The declaration that the token is encrypted at ~/.repo-manager/credentials.enc is not itself evidence of credential theft. The Skill does not instruct the Agent to read or transmit this file. However, the storage implementation and encryption quality cannot be validated because the external plugin source is absent.

Attack Path

  1. A user follows the documented recommendation during GitHub OAuth authorization.
  2. The user grants both repository access an ...[truncated 1086 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to grant the workflow scope from the free edition.
  2. Document the exact minimum GitHub permissions required for each supported operation.
  3. Prefer fine-grained GitHub authorization over broad classic OAuth scopes.
  4. Use read-only permissions by default and request write permissions only when a user invokes a write operation.
  5. Separate repository administration, content modification, issue management, pull request management, and workflow permissions.
  6. Require explicit, operation-specific consent before requesting any additional scope.
  7. Display the effective OAuth permissions and provide instructions for revoking or reducing them.
  8. Ensure that token storage uses operating-system credential facilities or authenticated encryption, restrictive file permissions, and redaction from logs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

文件整体以中文名称、摘要和说明面向所有用户提供能力描述，但未声明这是仅面向中文用户的区域性技能，也未提供语言/locale 选择。按组织语言策略，若技能隐含固定语言输出而没有用户选择或明确限定适用人群，属于自然语言层面的 locale 约束风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger condition is overly broad ('API integration, interface docking, webhook configuration, system connection'), which can cause the skill to activate in unrelated contexts. Because this skill exposes GitHub management and write-capable operations through exec/MCP tooling, over-triggering raises the chance of unnecessary OAuth prompts, repository data exposure in context, or accidental initiation of write workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

L414明确写明免费版“ 不支持工具目录搜索(仅支持列表浏览)”，但前文多处将search-tools作为可用能力进行说明和示例，包括L17、L307-L315、L358、L398。这不是单纯遗漏，而是文档内部对该技能是否支持工具搜索给出了相互矛盾的意图说明。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill recommends requesting the GitHub 'workflow' scope even though the documented functionality explicitly excludes Actions/workflow management. That violates least-privilege principles and can cause users to authorize broader repository automation access than necessary, increasing the blast radius if the plugin, agent, or token storage is compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Manifest描述把“工具发现与参数预览”列为核心能力，但L414又声明免费版“不支持工具目录搜索(仅支持列表浏览)”。对于一个以统一工具发现为卖点的技能，这造成对实际可用发现能力的语义不一致：描述承诺较强，实际限制明显更窄。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

L356声称“所有写操作(创建、更新、删除)”都遵循安全确认流程，但全文核心能力与示例仅覆盖创建类操作，未展示任何删除或更新类GitHub工具。由于该句主动声明存在删除类写操作，和文档实际呈现能力范围不一致，容易让人误判技能支持更高风险的修改能力。

Content

No source excerpt is available for this finding.