AutoPost GitHub Bounty

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious on its face, but it combines account tokens, intended public posting, and vulnerable HTTP dependencies without enough safety guidance.

Review this carefully before installing. Use least-privilege GitHub and social tokens, test with noncritical accounts, and update or pin dependencies before relying on it. The current script only logs the post text rather than actually posting, so verify behavior before granting social-platform credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins axios to 1.15.0, and the supplied advisory set indicates multiple known vulnerabilities affecting that version, including prototype-pollution-related request/response manipulation risks. Because axios is a core HTTP client dependency for a package named 'autopost-github-bounty', exploitation could affect outbound API calls, credentials, or response integrity if the vulnerable code paths are reachable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile includes form-data 4.0.5, and the reported CRLF-injection flaw can permit malicious multipart field names or filenames to alter generated HTTP multipart content. If this skill builds multipart requests using untrusted input, an attacker may smuggle headers or manipulate request bodies sent to external services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.15.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The finding indicates resolution to axios 1.15.0 with multiple known advisories, including prototype-pollution-related response tampering and credential theft/man-in-the-middle scenarios. In an auto-posting tool that likely makes authenticated HTTP requests to external services, a vulnerable HTTP client materially increases the risk of token compromise, response manipulation, and unauthorized actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes automated posting to social-media platforms and requires GitHub and social-platform API tokens, but it does not warn users about the risks of automated external actions, account misuse, accidental spam, or sensitive token handling. In this context, omission of those warnings increases the chance that a user grants powerful credentials and triggers public posting without understanding the security and reputational consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · autopost.js (reported line 10)May include surrounding context.

js

async function fetchRepoDetails(repoUrl) {
    try {
        const response = await axios.get(`https://api.github.com/repos/${repoUrl}`, {
            headers: { Authorization: `Bearer ${process.env.GITHUB_TOKEN}` }
        });
        return response.data;

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

No manifest is available, so there is no declared purpose that would justify accessing sensitive credentials. The code loads environment variables and uses process.env.GITHUB_TOKEN to authenticate to the GitHub API, which is a privileged capability beyond a generic unknown-purpose skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default message string is written in Vietnamese and will be used whenever no custom message is supplied. This imposes a specific language choice on users without offering a locale selection or documenting that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation is written entirely in Vietnamese and does not indicate any language choice, opt-in, or locale-specific justification. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile includes follow-redirects 1.15.11, which the finding reports as vulnerable to leaking custom authentication headers across cross-domain redirects. In a project that likely performs automated GitHub/API posting, unintended forwarding of tokens or auth headers during redirects can expose sensitive credentials to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description is written only in Vietnamese ("Tự động đăng bài cho chiến dịch GitHub Bounty"), which may indicate the skill is intended to operate in a specific language without any stated user opt-in or documented locale constraint. This is a natural-language policy concern because the manifest provides no indication that language selection is configurable or intentionally region-scoped.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Using a caret range for axios allows future minor/patch releases to be installed automatically, which can introduce unexpected behavior or pull in a newly vulnerable version through normal dependency resolution. In a skill that appears to automate posting and likely handles network access, dependency drift increases supply-chain risk and can affect confidentiality or integrity if a bad version is resolved.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"author": "Toàn Vũ",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.4.0",
    "dotenv": "^16.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

Using a caret range for dotenv permits non-deterministic installs over time, which is a supply-chain hygiene weakness even if dotenv itself is not shown here as vulnerable. Because dotenv is commonly used to load secrets from environment files, unexpected package changes can be risky in automation contexts that may process credentials or tokens.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "axios": "^1.4.0",
    "dotenv": "^16.0.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: autopost.js:11