GitHub AI Trends

• Verdict: Advisory
• Analyzed: Apr 30, 2026, 4:58 AM
• Findings: 0
• Version: 1.1.0
• Reason codes: None
• Engine: v2.4.5

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

If you provide a GitHub token, the skill can make GitHub API requests using that token's permissions.

Why it was flagged

The script can read a GitHub token from an argument or environment variable and send it as an Authorization header to the GitHub API. This is purpose-aligned for rate limits, but users should notice that a credential may be used.

Skill content

parser.add_argument("--token", default=os.environ.get("GITHUB_TOKEN")) ... headers["Authorization"] = f"Bearer {token}"

Recommendation

Use a low-scope GitHub token if needed, avoid broad or personal tokens when possible, and prefer an environment variable over pasting tokens into chat.