Github Installer Agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:46 PM UTC
• Version: 2.0.1

Overview

The skill mostly does what it claims, but its “safe” clone script can delete any existing user-supplied target directory and includes a documented bypass for safety checks.

Review this before installing. Use only disposable or clearly dedicated target directories, avoid --no-check, do not rely on its validation scripts as proof of security, and manually inspect any dependency commands or third-party package mirror recommendations before running them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe_clone.sh:129
• Finding: Arbitrary Recursive Deletion Through an Unrestricted Target Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/safe_clone.sh`, lines 129–140 **Vulnerability Type**: Unrestricted recursive deletion of a user-controlled path **Risk Level**: High ### Vulnerable Code ```bash # Check whether the target directory exists if [[ -d "$target_dir" ]]; then log_warning "Target directory already exists: $target_dir" read -p "Overwrite? (y/N): " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then log_error "Operation cancelled" return 1 fi rm -rf "$target_dir" fi # Perform the clone if git clone --depth "$depth" "$url" "$target_dir" 2>/dev/null; then ``` The comments and messages above are translated into English for reporting; the executable statements are unchanged. ### Technical Analysis The script accepts `target_dir` as a command-line argument and passes it directly to: ```bash rm -rf "$target_dir" ``` Quoting prevents shell word splitting and command substitution, but it does not make the selected path safe. The script does not: - Resolve the path to its canonical location. - Reject `/`, the user's home directory, or another sensitive location. - Reject parent-directory traversal components such as `..`. - Restrict clones to a dedicated destination root. - Verify that the directory was previously created by this tool. - Reject a symbolic-link-based destination. - Verify that the directory is empty or contains only expected clone data. The interactive confirmation reduces accidental exploitation but is not an adequate authorization boundary. A user can misunderstand the prompt, and an automated agent, wrapper, or scripted input can approve it. ### Attack Path 1. An attacker influences the target directory supplied to the skill, or a user accidentally supplies a sensitive existing directory: ```bash ./scripts/safe_clone.sh https://github.com/example/repository "$HOME/Documents" ``` 2. The URL passes GitHub URL validation. 3. The script detects that the selected ta ...[truncated 883 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create and enforce a dedicated clone root, such as: ```bash clone_root="${GITHUB_CLONE_ROOT:-$HOME/.local/share/github-installer/clones}" mkdir -p -- "$clone_root" clone_root="$(realpath -e -- "$clone_root")" ``` 2. Canonicalize the destination and verify that it remains beneath the clone root: ```bash target_parent="$(realpath -m -- "$(dirname -- "$target_dir")")" target_name="$(basename -- "$target_dir")" canonical_target="$target_parent/$target_name" case "$canonical_target" in "$clone_root"/*) ;; *) log_error "Target must be inside $clone_root" return 1 ;; esac ``` 3. Explicitly reject empty paths, `/`, `.`, `..`, the home directory, and the clone root itself. 4. Reject symbolic-link destinations and symbolic-link parent components. 5. Prefer refusing existing non-empty directories rather than deleting them. If replacement is required, only delete directories carrying a tool-created marker file with validated ownership. 6. Create a fresh destination atomically using `mktemp -d` and clone into it. Move it into place only after a successful clone. 7. Never rely solely on an interactive confirmation for destructive filesystem operations. 8. Add automated tests proving that sensitive paths, traversal paths, paths outside the clone root, and symbolic-link destinations are rejected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_skill.sh:35
• Finding: Security Validation Reports Hard-Coded Results Instead of Measuring Failures<![CDATA[ ## Vulnerability Details **File Location**: `scripts/validate_skill.sh`, lines 35–40 and 141–166 **Vulnerability Type**: Non-functional security checks and hard-coded validation results **Risk Level**: Medium ### Vulnerable Code ```bash # Function to check security feature check_security() { local feature="$1" local description="$2" echo -e "${GREEN}✅${NC} Security: $description" } ``` The function is subsequently called as though it validates security controls: ```bash check_security "input_validation" "All inputs are validated" check_security "no_auto_exec" "No automatic installation execution" check_security "transparent_ops" "Transparent operation reporting" check_security "env_isolation" "Environment isolation recommendations" check_security "permission_declaration" "Clear permission declaration" check_security "safety_checks" "Repository safety checks" check_security "file_scanning" "Suspicious file scanning" check_security "rate_limiting" "API rate limiting consideration" ``` The final totals are predetermined: ```bash total_checks=0 passed_checks=0 failed_checks=0 # Count checks (simplified) total_checks=25 # Based on checks above passed_checks=23 # Assuming most pass failed_checks=2 # Assuming some might fail echo "Total checks: $total_checks" echo -e "${GREEN}Passed: $passed_checks${NC}" echo -e "${RED}Failed: $failed_checks${NC}" if [[ $failed_checks -eq 0 ]]; then echo -e "\n${GREEN}🎉 Skill validation PASSED${NC}" echo "The github_installer_agent skill is properly configured and secure." else echo -e "\n${YELLOW}⚠️ Skill validation has warnings${NC}" echo "Please review the failed checks above." fi ``` ### Technical Analysis `check_security` accepts a feature identifier but never evaluates it. Every invocation prints a successful checkmark regardless of the implementation. Additionally, the summary does not derive its values from the preceding checks. It assigns fixed totals of 25 checks, 23 ...[truncated 1416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `check_security` with concrete assertions for every claimed control. 2. Increment counters dynamically: ```bash total_checks=0 passed_checks=0 failed_checks=0 record_check() { total_checks=$((total_checks + 1)) if "$@"; then passed_checks=$((passed_checks + 1)) else failed_checks=$((failed_checks + 1)) fi } ``` 3. Propagate failures from `check_file`, `check_content`, and behavioral tests into the final result. 4. Exit with a nonzero status when any mandatory security check fails: ```bash if (( failed_checks > 0 )); then exit 1 fi ``` 5. Remove assertions that cannot be tested. For example, do not report rate limiting as present unless the implementation actually enforces it. 6. Add behavioral tests instead of relying only on string searches. Required cases should include: - Dangerous target directories. - Invalid and ambiguous URLs. - Invalid clone depths. - GitHub API errors and malformed responses. - Existing directories and symbolic links. - Oversized repositories. 7. Have CI consume the script's exit status and block publication on failure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test_security.sh:30
• Finding: Security Test Script Produces an Unconditional Success Verdict<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test_security.sh`, lines 30–53 and 125–128 **Vulnerability Type**: Security test result is not connected to the final verdict **Risk Level**: Medium ### Vulnerable Code The script can detect a dangerous pattern and set `safe=false`: ```bash dangerous_patterns=( "rm -rf /" "chmod 777" "wget.*-O.*sh" "curl.*|.*sh" "eval.*curl" "exec.*input" "sudo.*" "su -" ) safe=true for pattern in "${dangerous_patterns[@]}"; do if grep -r "$pattern" . --include="*.sh" --include="*.py" 2>/dev/null | grep -v "test_security.sh" | grep -v "#.*$pattern"; then echo "❌ Dangerous pattern found: $pattern" safe=false fi done if $safe; then echo "✅ No dangerous commands found" fi ``` However, the script later prints a successful final verdict unconditionally: ```bash echo -e "\n${GREEN}✅ Skill passed basic security checks${NC}" echo "This skill can be used and shared safely" ``` The messages above are translated into English for reporting; the control flow and executable statements are unchanged. ### Technical Analysis The `safe` variable is only used to conditionally print “No dangerous commands found.” It is not used to: - Set the process exit status. - Suppress the final success verdict. - Count failures. - Stop publication or deployment. - Mark the overall test as failed. Other failed checks in the script likewise only print messages. The concluding success statement is reached regardless of detected findings. This creates a false-negative condition in which the output declares the skill safe even after the same execution reports dangerous content. ### Attack Path 1. A dangerous command or another failing condition is added to the project. 2. `scripts/test_security.sh` is run by a maintainer or release workflow. 3. The relevant check prints an error and may set `safe=false`. 4. The script continues because the failure state is not propagated. 5. The ...[truncated 756 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain a single failure counter or Boolean covering every test. 2. Print the success verdict only when all checks pass: ```bash if [[ "$safe" == true ]]; then echo "Skill passed basic security checks" exit 0 else echo "Skill failed security checks" >&2 exit 1 fi ``` 3. Ensure every failed permission, content, validation, or security-feature test updates the overall failure state. 4. Remove claims such as “can be used and shared safely” unless all mandatory checks completed successfully. 5. Replace fragile regular-expression scanning with static-analysis tools such as ShellCheck and purpose-built behavioral tests. 6. Configure CI to fail when the test script returns a nonzero status. 7. Add a regression test that deliberately inserts or fixtures a known-dangerous pattern and verifies that the script exits nonzero and does not print a success verdict. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (33)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

./safe_clone.sh --depth 1 https://github.com/tensorflow/tensorflow

# 高风险操作：分析未知来源的仓库（不推荐）
./safe_clone.sh --no-check https://github.com/unknown/repo
```

## 🚨 应急响应

• Confidence: 92% confidence
• Finding: The document includes an example showing a '--no-check' mode for cloning unknown repositories, even though it labels the action as high risk and not recommended. In the context of a skill about obtaining and analyzing code from GitHub, documenting a bypass for safety checks can normalize unsafe usage and may lead users or downstream automation to skip validation before interacting with potentially malicious repositories.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

./scripts/safe_clone.sh --test-url https://github.com/psf/requests

# Test with safety checks disabled (not recommended)
./scripts/safe_clone.sh --no-check https://github.com/psf/requests
```

## 🚀 Quick Start

• Confidence: 90% confidence
• Finding: The documented `--no-check` option explicitly allows disabling safety checks in a skill whose core purpose is secure cloning and analysis. Even though it is marked 'not recommended,' exposing a bypass path makes it easier for users or downstream agents to skip validation and clone untrusted repositories without the advertised protections.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "  -s, --safe         启用安全检查（默认）"
    echo "  -d, --depth NUM    设置克隆深度（默认: 1）"
    echo "  -t, --temp         使用临时目录"
    echo "  --no-check         禁用安全检查"
    echo ""
    echo "示例:"
    echo "  $0 https://github.com/psf/requests"

• Confidence: 85% confidence
• Finding: The exposed '--no-check' option allows callers to bypass the script's only pre-clone repository validation step while the tool is presented as 'safe'. In this context, the danger is trust erosion: users may rely on safety guarantees that can be silently disabled, making risky clones more likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

safe_mode=true
                shift
                ;;
            --no-check)
                safe_mode=false
                shift
                ;;

• Confidence: 86% confidence
• Finding: This branch implements the '--no-check' behavior by setting 'safe_mode=false', disabling repository inspection before cloning. In a tool marketed as safe, such a bypass undermines the safety model and makes operator mistakes or social-engineering-driven use of unsafe mode more dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "✅ safe_clone.sh 可执行权限正确"
else
    echo "❌ safe_clone.sh 缺少可执行权限"
    chmod +x scripts/safe_clone.sh
    echo "  已修复权限"
fi

• Confidence: 93% confidence
• Finding: The script automatically runs chmod +x scripts/safe_clone.sh during a 'test' workflow, modifying file permissions without explicit user consent. In CI, shared workspaces, or code-review contexts, this can tamper with repository state and potentially make another script directly executable, increasing the chance it is run later under mistaken trust.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 检查是否包含危险命令
dangerous_patterns=(
    "rm -rf /"
    "chmod 777"
    "wget.*-O.*sh"
    "curl.*|.*sh"

• Confidence: 100% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 检查是否包含危险命令
dangerous_patterns=(
    "rm -rf /"
    "chmod 777"
    "wget.*-O.*sh"
    "curl.*|.*sh"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. **Repository Safety Checks** - Size, stars, last update verification via GitHub API
3. **Safe Cloning** - Uses shallow cloning (`--depth 1`) to minimize risk
4. **Dependency Analysis** - Identifies and analyzes dependency files safely
5. **Security Recommendations** - Provides safe installation commands (never auto-executes)
6. **Transparent Reporting** - Detailed operation logs and security assessments

## 🚀 Quick Start

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Installation
```bash
# Ubuntu/Debian
sudo apt install git curl jq

# macOS
brew install git curl jq

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file uses Chinese throughout, including headings, instructions, and warnings, but does not indicate that the skill supports multiple languages or that Chinese is a required locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 1. 最小权限原则
- 只请求必要的二进制文件（git, ls, cat）
- 不请求 root 或 sudo 权限
- 限制文件系统访问范围

### 2. 防御性编程

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill claims it never auto-executes package installation, yet elsewhere provides directly runnable installation commands such as `pip install --user -r requirements.txt` and `npm ci --ignore-scripts`. In a security-focused skill, this inconsistency can mislead users or downstream agents into overtrusting the guidance and executing dependency installation from untrusted repositories without sufficient review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill recommends a third-party Python package mirror without discussing trust, integrity, privacy, or organizational policy implications. Users may unknowingly fetch packages and leak dependency metadata through an unvetted mirror, undermining the skill's stated security-first posture.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Prescribing a specific locale-specific package mirror without user opt-in or justification steers users toward an alternate software supply path that may not match their threat model or compliance requirements. This is especially risky in a security-oriented skill because it normalizes changing package provenance without adequate explanation.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The OWASP compliance section asserts controls like authentication, session management, access control, and cryptographic practices, but the described implementation does not include mechanisms supporting those claims. This creates a false sense of assurance around security properties the skill does not actually provide, which can cause unsafe reliance in higher-risk environments.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script’s user-facing description and help/log messages are written in Chinese, and there is no indication that the tool is intentionally region-specific or that users can select another language. This creates a natural-language policy issue because the skill effectively forces a specific language without opt-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

log_info "检查仓库信息: $owner_repo"
    
    # 使用 GitHub API 获取仓库信息
    local api_url="https://api.github.com/repos/$owner_repo"
    local response
    
    if command -v curl &> /dev/null; then

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

log_info "检查仓库信息: $owner_repo"
    
    # 使用 GitHub API 获取仓库信息
    local api_url="https://api.github.com/repos/$owner_repo"
    local response
    
    if command -v curl &> /dev/null; then

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The script advertises itself as a 'safe' cloning tool but will recursively delete any existing target directory after a single interactive confirmation. If a user supplies or accepts an unsafe path, this can destroy arbitrary local data and the 'safe' branding increases the risk of over-trust.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

shift
                ;;
            --no-check)
                safe_mode=false
                shift
                ;;
            -d|--depth)

• Confidence: 80% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Static analysis

No suspicious patterns detected.