ClawHub
Back to skill

Security audit

GitHub AI Trends

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches GitHub AI repository trends, but users should be careful with optional GitHub tokens and untrusted repository text rendered in the report.

Install only if you are comfortable with the skill making GitHub API requests. Prefer running without a token, or use a fine-grained short-lived GitHub token via environment variable rather than --token. Treat repository descriptions and links in the generated leaderboard as untrusted GitHub content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_trends.py:99
Finding

GitHub Token Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_trends.py:76
Finding

Untrusted GitHub Repository Metadata Rendered as Unsanitized Markdown

Content
View full analysis
80: desc = desc[:77] + "..." name = r["full_name"] url = r["html_url"] lines.append(f"**#{i}** [{name}]({url})") lines.append(f"⭐ {stars} · 🍴 {forks} · {lang}") if desc: lines.append(f"_{desc}_") lines.append("") ``` ### Technical Analysis Repository descriptions and other metadata originate from GitHub repositories controlled by external users. The script treats those values as trusted presentation content and inserts them directly into Markdown. Truncating the description to 80 characters limits length but does not neutralize Markdown metacharacters, links, mentions, embedded HTML supported by some renderers, or instruction-like text. Because `SKILL.md` directs the Agent to paste standard output directly into its reply, crafted repository metadata can cross the trust boundary from an external API into Agent-visible and user-visible content. The primary confirmed risk is Markdown or content injection, including deceptive formatting and unsolicited links. Depending on how a consuming Agent processes tool output, instruction-like metadata may also create an indirect prompt-injection risk. The au ...[truncated 1425 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to run a local script that performs network access to GitHub and may consume a GitHub token from the environment, but the skill does not declare any tool scope or permission boundaries. This creates an undeclared capability mismatch: an agent or reviewer cannot tell from the manifest that network and environment access are required, increasing the risk of over-privileged execution and unintended secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says to use the skill when the user asks for "AI project trends," "GitHub trending," "AI leaderboard," or "wants to see popular AI repos." Several of these are broad natural-language descriptions rather than narrowly scoped invocation phrases, which may cause unintended activation for general discussion requests. The file also does not provide exclusion conditions or negative examples to clarify when the skill should not trigger.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_trends.py (reported line 21)May include surrounding context.

python
params = urllib.parse.urlencode({
        "q": query, "sort": sort, "order": order, "per_page": per_page
    })
    url = f"https://api.github.com/search/repositories?{params}"
    headers = {"Accept": "application/vnd.github+json", "User-Agent": "github-ai-trends"}
    if token:
        headers["Authorization"] = f"Bearer {token}"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script hard-codes Chinese output strings such as period labels, which imposes a specific language on users by default. This is a natural-language locale policy concern because there is no user opt-in, configuration flag, or justification that the skill is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

User-facing strings like the leaderboard title and generation time text are fixed in Chinese, so the script enforces a specific language choice on all users. Because there is no alternative locale setting or documented justification, this matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.