GitHub Code Analyzer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:25 AM UTC
• Version: 1.0.0

Overview

This GitHub code analyzer has a legitimate purpose, but it runs an unsafe shell clone command and sends sampled repository code to an external API without precise disclosure or consent.

Review before installing. Only use this skill on public, non-sensitive repositories, and only in a sandboxed environment with no valuable local files or credentials accessible. It should be fixed to use spawn or execFile with strict GitHub URL validation, reject symlinks, remove the embedded credential-like value, disclose the actual external API recipient and transmitted data, and require consent before sending code to a third party.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:17

Finding

Arbitrary Command Execution Through Shell Injection in Repository URL

Content

View full analysis

{ exec(cmd, { timeout }, (err, stdout, stderr) => { if (err) reject(err); else resolve(stdout); }); }); } ``` ### Technical Analysis The user-controlled `repoUrl` is directly interpolated into a command string passed to Node.js `child_process.exec`. The `exec` function launches a shell, so shell metacharacters in the URL are interpreted as command syntax. The regular expression is not a security boundary. It merely searches for a substring resembling `github.com/owner/repository`; it does not anchor the input, validate the URL hostname, constrain the complete repository path, or reject characters such as semicolons, command substitutions, pipes, redirections, or shell comments. Consequently, an input can contain a syntactically valid GitHub substring and additional shell commands. ### Attack Path 1. An attacker invokes the skill with a repository argument such as: ```text https://github.com/example/repository; touch /tmp/clawhub-pwned # `` ...[truncated 1033 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:68

Finding

Local File Disclosure Through Repository-Controlled Symbolic Links

Content

View full analysis

maxDepth) return; const items = fs.readdirSync(dir); for (const item of items.slice(0,15)) { if (item.startsWith('.')) continue; const fullPath = path.join(dir, item); const stat = fs.statSync(fullPath); result.push(' '.repeat(depth) + (stat.isDirectory() ? '📁 ' + item : '📄 ' + item)); if (stat.isDirectory()) walk(fullPath, depth + 1); } } walk(dir); return result.slice(0, 50).join('\n'); } async function getCodeSamples(dir) { const extensions = ['.js', '.ts', '.py', '.go', '.java', '.cpp']; const samples = []; function findFiles(dir) { const items = fs.readdirSync(dir); for (const item of items) { if (samples.length >= 3) return; const fullPath = path.join(dir, item); const stat = fs.statSync(fullPath); if (stat.isDirectory() && !item.startsWith('.') && item !== 'node_modules') { findFiles(fullPath); } else if (extensions.some(ext => item.endsWith(ext))) { const content = fs.readFileSync(fullPath, 'utf-8').slice(0, 2000); samples.push(`📄 ${item}\n\`\`\`\n${content}\n\`\`\``); } } } findFiles(dir); return samples.join('\n\n'); } ``` The collected content is later incorporated into an external API request: ```js const prompt = `请分析 GitHub 项目 ${owner}/${repo}： ## 项目结构 ${structure} ## 代码示例 ${codeSamples} ... `; const response = await axios.post( 'https://ark.cn-beijing.volces.com/api/v3/chat/completions', { model: model, messages: [{ role: 'user', content: prompt }], temperature: 0.7 }, { timeout: 60000 } ); ``` ### Technical Analysis A Git repository can contain symbolic links. Both tr ...[truncated 2289 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:7

Finding

Credential-Like API Key Embedded in Source Code

Content

View full analysis

Remediation

View remediation

other

Note

• Location: index.js:106

Finding

Repository Source Code Is Sent to an External Provider Without Precise Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description is broadly aligned with the high-level purpose of analyzing GitHub project code quality, but it omits several materially important behaviors and resources. The implementation clones repositories via shell execution, traverses and reads local files, and sends extracted code samples and project structure to an external ARK API endpoint using a hardcoded credential. Those are significant undeclared capabilities and resource accesses, especially because declared permissions are empty. Therefore this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

text

analyze https://github.com/owner/repo
analyze https://github.com/owner/repo --model deepseek

Parameters

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

analyze https://github.com/Openwrt-Passwall/openwrt-passwall

Use specific model

analyze https://github.com/facebook/react --model deepseek-coder

text

## Supported Models

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill invokes git clone via a shell using untrusted user input (repoUrl) to fetch arbitrary repositories. This gives the skill command-execution-adjacent system access beyond simple analysis, and the repository URL is interpolated into the shell command without escaping, which also introduces command injection risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Repository code samples are transmitted to ark.cn-beijing.volces.com without any user-facing warning, opt-in, or indication of data sharing. In a code-analysis context this is especially dangerous because repositories may contain confidential code, embedded credentials, or internal logic not intended for third-party processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says it 'Integrates with DeepSeek API for AI analysis' but does not clearly warn users that repository contents, code samples, or metadata may be sent to an external service. Even for public repositories, this can create compliance, privacy, or user-expectation issues, and becomes more dangerous if users later use the skill on private or sensitive code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states the skill analyzes code in Chinese, and the prompt later explicitly instructs the model to respond '用中文'. This imposes a language choice without offering the user an alternative or requiring opt-in, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill performs local shell execution and recursive filesystem deletion in a temporary directory without telling the user. While cleanup itself is expected, undisclosed system-level actions reduce user transparency, and in this implementation the shell command is particularly risky because it operates on attacker-controlled input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The analysis prompt instructs the model to produce results in Chinese only. Because no language-selection mechanism is present elsewhere in the file, this is a forced language constraint rather than an opt-in preference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends extracted repository structure and code samples to a third-party AI API, but its description only says it analyzes GitHub code quality and does not disclose external transmission. This can expose proprietary, sensitive, or regulated source code to an external service and expands the data-handling scope beyond what a user would reasonably expect.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:66

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: index.js:7