ClawHub
Back to skill

Security audit

GitVerse API

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its GitVerse purpose, but it can attach your GitVerse token to an undocumented custom API endpoint, creating a meaningful credential-exposure risk.

Review carefully before installing. Use a narrowly scoped, revocable GitVerse token, avoid running the CLI from directories with untrusted .env files, and do not set GITVERSE_BASE_URL unless you intentionally trust that endpoint. Confirm repository, branch, and title before allowing the skill to create a pull request.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
src/client.ts:7
Finding

Authenticated API Requests Can Be Redirected to an Arbitrary Server

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Based on the supplied code chunk, the implementation only performs dotenv configuration import, a generic setup action for loading environment variables. There is no visible logic for connecting to gitverse.ru, making API requests, handling repositories, issues, or pull requests. Because the declared description claims a GitVerse integration as the skill's purpose, but the actual provided code does not substantiate that behavior and instead only shows unrelated initialization scaffolding, this is a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The pulls merge command is presented with no cautionary text, even though merging a pull request changes repository history/state and may be difficult to undo. For markdown skill documentation, this kind of behavior should be clearly warned about because it can materially affect user data and repository integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

md
Use this skill when you need to:
- List or view repositories
- List or view issues
- List, view, or create pull requests
- View repository information

## Installation via OpenClaw

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents a state-changing operation (pulls create) that affects a remote repository, but it does not include any warning or caution about creating a new pull request on the user's behalf. Under the markdown-specific warning criteria, actions that can affect user data or system integrity should be disclosed clearly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares executable behavior involving environment variables and network access but does not define any explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and can allow broader-than-expected access to credentials and outbound requests if the runtime honors skill metadata for safety decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation text includes a broad catch-all scope like 'any other GitVerse operations,' which can cause an agent to invoke the skill for unbounded actions beyond those specifically described. In agent ecosystems, overly broad routing language increases the chance of unintended high-impact operations being selected without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
Use this skill when you need to:
- List or view repositories
- List or view issues
- List, view, or create pull requests
- View repository information

## Installation

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill tells users to place an access token in an environment variable or .env file but provides no guidance on secure storage, file permissions, redaction, or avoiding accidental commits. This increases the risk of credential exposure, especially because .env files are commonly leaked through logs, shell history, or repository inclusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs creation of pull requests, which changes remote repository state, but does not warn that this is a write operation requiring explicit user approval. In an agent context, omission of that warning can lead to unintended code publication, workflow triggers, or repository modifications under the user's credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The usage section shows only Russian prompt examples and frames invocation as "When you ask me to work with GitVerse" using Russian utterances, with no indication that other languages are supported or that Russian is an intentional, justified restriction. This can be read as imposing a locale expectation without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The document instructs users to export GITVERSE_TOKEN but does not warn that this is a sensitive credential that should be protected from shell history, logs, and accidental sharing. Markdown skill descriptions should disclose privacy- or security-relevant handling when user credentials are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown documents issues close as a command to close an issue, but provides no warning that it changes remote repository state. Under the markdown-specific warning rule, actions that can affect user data or system integrity should disclose their impact so users are not surprised by state-changing operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language invocation examples are presented only in Russian (e.g. "Покажи мои репозитории", "Создай PR в saic/chatbot") and imply that the skill is triggered through that language alone. There is no accompanying note that other languages are supported or that Russian is merely an example, which creates a locale/language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency uses a caret range, which allows future minor and patch versions to be installed. This can introduce supply-chain risk because a newly published compromised or breaking upstream release could be pulled into builds without explicit review, especially for a skill that interfaces with external APIs and may handle tokens or repository metadata.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"author": "AI Center",
  "license": "MIT",
  "dependencies": {
    "@onreza/gitverse-sdk": "^1.0.4",
    "commander": "^12.1.0",
    "dotenv": "^16.6.1"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The commander package is referenced with a caret version, so installations may resolve to newer releases than the author tested. While common in Node projects, this still creates a supply-chain exposure window where an upstream compromised release or unexpected behavior change could affect CLI parsing or execution paths.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@onreza/gitverse-sdk": "^1.0.4",
    "commander": "^12.1.0",
    "dotenv": "^16.6.1"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dotenv dependency is not pinned to an exact version, allowing dependency drift across environments. In a skill likely to consume API credentials from environment files, any compromised or faulty upstream update could affect secret loading behavior or execution reliability.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"dependencies": {
    "@onreza/gitverse-sdk": "^1.0.4",
    "commander": "^12.1.0",
    "dotenv": "^16.6.1"
  },
  "devDependencies": {
    "@types/node": "^20.19.37",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json
"dotenv": "^16.6.1"
  },
  "devDependencies": {
    "@types/node": "^20.19.37",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.19.37",
    "typescript": "^5.9.3"
  }
}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code file defines a create command that will create a pull request via pulls.createPull, which is a remote write operation against a repository service. In this file there is no visible confirmation prompt, warning text, or user-facing disclosure that the command changes remote state, unlike the read-only list/view commands around it.

Content

No source excerpt is available for this finding.