Security audit

GitHub项目分析助手

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its GitHub analysis purpose, but it uses mutable third-party installs and raw GitHub token shell commands that should be reviewed before use.

Review before installing. Prefer a pinned commit or release, inspect the optional search/content-extraction dependencies before enabling them, avoid symlinking live checkouts from /tmp, and do not provide a broad GitHub PAT. If authentication is needed, use a fine-grained read-only token through a protected credential mechanism and confirm before broad community searches.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:24
Finding: Unpinned Third-Party Skill Installation and Execution
Content: View full analysis
Vulnerability Details

File Location: README.md:24-60
Vulnerability Type: Supply-chain exposure through unpinned remote dependencies
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/blessonism/github-explorer-skill

bash
git clone https://github.com/blessonism/openclaw-search-skills.git /tmp/openclaw-search-skills cd ~/.openclaw/workspace/skills ln -s /tmp/openclaw-search-skills/search-layer search-layer ln -s /tmp/openclaw-search-skills/content-extract content-extract ln -s /tmp/openclaw-search-skills/mineru-extract mineru-extract

Technical Analysis

The installation instructions retrieve third-party content from mutable remote sources without pinning an audited package version, release, tag, or commit hash. No checksum or cryptographic signature verification is required.

The cloned repository is placed under /tmp and its components are symlinked directly into the active Skill directory. Consequently, later changes to the checkout can immediately change what the Agent executes. The npx workflow may also download and run installer-related package code that is not fixed to a reviewed version.

This creates a supply-chain trust boundary in which the effective instructions and executable scripts can change after this Skill has been audited. Compromise of the upstream repository, its maintainer account, the package distribution channel, or the local temporary checkout could introduce attacker-controlled code.

Attack Path

An attacker compromises an upstream repository, package, maintainer account, or distribution channel referenced by the installation instructions.

The attacker adds malicious instructions or executable scripts to the mutable dependency.

A user runs the documented npx or git clone installation command.

The remote content is installed or linked into the Agent’s active Skill directory without version pinning or inte ...[truncated 946 chars]
Remediation: View remediation
Remediation Suggestions

Pin every repository dependency to a reviewed commit hash or immutable signed release.

Pin the npx installer and associated packages to explicit, audited versions.

Publish expected SHA-256 checksums or signed provenance and verify them before installation.

Avoid symlinking mutable repositories under /tmp into the active Skill directory.

Copy reviewed artifacts into a protected, versioned installation directory instead.

Prevent automatic updates from changing executable Skill content without review.

Run third-party Skills in a sandbox with minimal filesystem, credential, subprocess, and network access.

Review the dependency scripts before activation and repeat the review for every upgrade.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: GitHub Personal Access Token Exposed Through Process Arguments
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:34-40
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code

bash
curl -s -H "Authorization: token {PAT}" -H "Accept: application/vnd.github.v3.raw" "https://api.github.com/repos/{owner}/{repo}/readme" curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}" curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10" curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10" curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"

The instructions then state that the PAT can be found in TOOLS.md.

Technical Analysis

The GitHub PAT is interpolated directly into the curl command line as an HTTP authorization header. Although transmitting a token to the official GitHub API can legitimately support authenticated repository analysis, placing the secret in process arguments exposes it to additional local observation channels.

Depending on the operating system and runtime configuration, command arguments may be visible through process inspection interfaces, monitoring agents, audit systems, shell traces, debugging output, command logs, or Agent transcripts. Referring to a PAT stored in TOOLS.md also suggests plaintext credential retrieval from a documentation or configuration file.

Authentication is not required for every declared use case. Public GitHub repository metadata can generally be queried without a PAT, subject to lower rate limits. Automatically using a PAT for all requests therefore exceeds minimum privilege when unauthenticated access would be sufficient.

Attack Path

The Agent retrieves the PAT referenced by the Skill.

The {PAT} placeholder is replaced with the real credential.

...[truncated 1315 chars]
Remediation: View remediation
Remediation Suggestions

Use unauthenticated GitHub API requests by default for public repositories.

Request authentication only when rate limits or private-repository access make it necessary.

Use a fine-grained, read-only, repository-restricted, short-lived token.

Prefer GitHub CLI authentication backed by an operating-system credential store or another protected credential helper.

Do not interpolate secrets directly into command-line arguments.

If curl must be used, place the authorization header in a temporary configuration or header file with permissions set to 0600, pass the file to curl, and delete it immediately after use.

Ensure that the temporary file is created atomically in a protected directory and is not written under a shared /tmp path without secure creation controls.

Do not store PAT values in Markdown documentation such as TOOLS.md.

Redact authorization headers from logs, traces, diagnostics, and Agent transcripts.

Document token rotation and immediate revocation procedures for suspected disclosure.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises collection from many external sources including GitHub, Chinese community sites, blogs, and Twitter, but does not prominently warn users that invoking the skill may initiate extensive outbound requests and third-party data access. In context, this is more dangerous because the skill is explicitly designed for multi-source scraping and enrichment, so users may unknowingly cause privacy-sensitive or policy-sensitive network activity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx skills add against a remote GitHub source without any version pinning or integrity verification. This creates a supply-chain risk: if the referenced repository or its fetched dependencies change, users may install unexpected or malicious code under the trusted skill name.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation examples use very broad, everyday Chinese phrases such as '帮我看看这个项目' and '了解一下 XXX', which can cause the skill to trigger in situations the user did not clearly intend. Because this skill performs broad external collection and analysis, overbroad triggers increase the chance of unintended network access, data fetching, and tool execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger criteria are broad enough to activate on generic requests to 'analyze a project' or '看看这个项目', without firmly constraining the target to a GitHub repository. Over-broad activation is dangerous in agent systems because it can invoke a capability-heavy workflow, including external searches and scripted collection, in contexts the user did not clearly intend.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill directs execution of local Python scripts and shell commands as part of normal operation, which broadens behavior from simple content analysis into arbitrary local command execution. In an agent setting, this increases attack surface because user-controlled project names or URLs may flow into command arguments, and the skill normalizes invoking auxiliary code outside tightly constrained built-in tools.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: At L033 the file states that using web_fetch on github.com repo pages is prohibited because GitHub repo pages are SPA shells and '一律使用 GitHub API'. But L046 still lists GitHub Repo collection with web_fetch as the recommended tool, creating an active contradiction in operational guidance.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This finding reflects outbound transmission to GitHub's API using an Authorization header containing a PAT. External transmission is expected for repo analysis, but the credentialed form makes it materially riskier because secrets are sent off-box and may be logged, reused, or exposed through debugging and tool traces.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
### Phase 2: 多源采集（并行） **⚠️ GitHub 页面抓取规则（强制）**：GitHub repo 页面是 SPA（客户端渲染），`web_fetch` 只能拿到导航栏壳子，**禁止用 web_fetch 抓 github.com 的 repo 页面**。一律使用 GitHub API： - README: `curl -s -H "Authorization: token {PAT}" -H "Accept: application/vnd.github.v3.raw" "https://api.github.com/repos/{owner}/{repo}/readme"` - Repo 元数据: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}"` - Issues: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10"` - Commits: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10"`

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs use of a GitHub personal access token and points the operator to another file to obtain it, expanding a public repo-analysis workflow into credentialed access and secret handling. Even if intended for legitimate API use, embedding PAT-based guidance in a broadly triggered skill increases the chance of unnecessary secret exposure, token misuse, and over-privileged outbound requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This line instructs another authenticated API call to GitHub, again transmitting a PAT externally. While the destination is legitimate, the skill bakes credentialed network access into normal execution, increasing the risk of secret leakage and unnecessary privileged requests during routine analysis.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
**⚠️ GitHub 页面抓取规则（强制）**：GitHub repo 页面是 SPA（客户端渲染），`web_fetch` 只能拿到导航栏壳子，**禁止用 web_fetch 抓 github.com 的 repo 页面**。一律使用 GitHub API： - README: `curl -s -H "Authorization: token {PAT}" -H "Accept: application/vnd.github.v3.raw" "https://api.github.com/repos/{owner}/{repo}/readme"` - Repo 元数据: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}"` - Issues: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10"` - Commits: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10"` - File tree: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This authenticated Issues API request sends a PAT to an external service as part of ordinary skill behavior. Because the skill is broadly triggered, normalizing repeated token-bearing outbound calls increases exposure surface and may permit collection beyond what is necessary for the user's request.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
**⚠️ GitHub 页面抓取规则（强制）**：GitHub repo 页面是 SPA（客户端渲染），`web_fetch` 只能拿到导航栏壳子，**禁止用 web_fetch 抓 github.com 的 repo 页面**。一律使用 GitHub API： - README: `curl -s -H "Authorization: token {PAT}" -H "Accept: application/vnd.github.v3.raw" "https://api.github.com/repos/{owner}/{repo}/readme"` - Repo 元数据: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}"` - Issues: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10"` - Commits: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10"` - File tree: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This commit-fetching API call also transmits a PAT externally, compounding the same secret-handling concern. The context makes this more sensitive because the skill is for public project exploration, so authenticated collection is often optional yet presented as mandatory.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
- README: `curl -s -H "Authorization: token {PAT}" -H "Accept: application/vnd.github.v3.raw" "https://api.github.com/repos/{owner}/{repo}/readme"` - Repo 元数据: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}"` - Issues: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10"` - Commits: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10"` - File tree: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"` PAT 见 TOOLS.md。

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The recursive file-tree API call sends a PAT and can enumerate an entire repository tree, creating a broader data-collection and transmission footprint than lightweight metadata retrieval. In combination with the instruction that 'PAT 见 TOOLS.md', this suggests operational access to reusable credentials and encourages privileged, high-volume external extraction beyond minimal repo review needs.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- Repo 元数据: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}"` - Issues: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/issues?state=all&sort=comments&per_page=10"` - Commits: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/commits?per_page=10"` - File tree: `curl -s -H "Authorization: token {PAT}" "https://api.github.com/repos/{owner}/{repo}/git/trees/{branch}?recursive=1"` PAT 见 TOOLS.md。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction "中文输出，技术术语保留英文" forces a specific language/locale behavior. Under the policy, language constraints should either be optional, user-selected, or clearly justified as region-specific; no such opt-in or justification is provided here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Missing User Warnings

Rp1

Vague Triggers

Vague Triggers

Context-Inappropriate Capability

Intent-Code Divergence

External Transmission

Context-Inappropriate Capability

External Transmission

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Static analysis