Security audit

GitToQuark

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear GitHub-to-Quark purpose, but its install and runtime instructions rely on missing wrapper scripts while requesting persistent cloud-drive authorization and automatic external calls.

Review the package before installing and do not authorize Quark Cloud Drive unless you are comfortable with a downloaded external CLI, persistent credentials in your home directory, geolocation checks, possible proxy-routed GitHub downloads, and the missing wrapper scripts noted above.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:66