Security audit

GitHub Track

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does GitHub repository tracking, but it includes under-disclosed Slack posting and broad credential guidance that users should review before installing.

Review scripts/daily-report.sh before running or scheduling it, especially the Slack block and hard-coded channel. Use no GitHub token for public repositories when possible, or a fine-grained read-only token with minimal repository access; avoid broad repo scope unless you intentionally need private repository access. Be aware that tracked repository metadata is stored under ~/.openclaw/workspace/memory and scheduled cron/systemd setup will keep running until disabled.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes use of environment secrets, local file reads/writes, and outbound network access, but does not declare permissions or clearly scope them. This weakens user consent and review because the skill can access tokens, persist data, and transmit requests externally without explicit capability disclosure.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill requests a GitHub token with broad `repo` scope even though its stated function is read-only monitoring of repository metadata, issues, and PRs. Over-privileged tokens increase blast radius: if the skill, its storage, or logs are compromised, an attacker could read private repositories and potentially access far more data than needed.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script transmits the generated GitHub tracking report to an external Slack channel, which extends behavior beyond local reporting/monitoring. Even if the content is not obviously secret, repository tracking data and derived summaries are exfiltrated to a third-party destination without explicit user consent or clear disclosure, creating an unnecessary data-sharing path.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script accesses a Slack token from the environment and uses it to post content externally, which is outside the stated GitHub-tracking purpose. Using ambient credentials in this way increases the attack surface because any execution context with that token will silently enable outbound messaging to Slack.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill reads a GitHub token from an unrelated local TOOLS.md file in the workspace, which exceeds the minimum access needed for a repository tracking utility and creates an implicit secret-discovery behavior. This can unexpectedly consume credentials from a broader context without user knowledge, increasing the risk of unauthorized token use or accidental disclosure through future changes, logging, or error handling.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README instructs users to place a GitHub personal access token in a local workspace file but does not warn that the token is a sensitive credential, recommend least-privilege scopes, or describe secure storage options. This can lead users to store long-lived secrets in plaintext in broadly accessible locations, increasing the risk of credential disclosure and unauthorized repository access if the file is exposed.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The README documents installation of cron/systemd scheduled execution without clearly warning that the task will continue running automatically and write tracking data over time. While this is expected functionality for a tracker, users may enable persistence without understanding the ongoing execution and local state changes, which can surprise them and complicate system hygiene or incident response.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill persists repository tracking configuration and history to local memory files but does not clearly surface this as persistent storage behavior at the point of use. While the stored content is not highly sensitive by itself, undisclosed retention can surprise users, expose monitoring interests, and increase forensic data left on disk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script sends report content to Slack with only a generic status message and no meaningful warning, confirmation, or preview. This weak transparency makes unintended external sharing more likely, especially in an agent skill context where users may expect local reporting rather than automatic publication to a chat system.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Silently reading credentials from TOOLS.md without any warning or consent is a transparency and secret-handling problem. Users invoking a repo-tracking skill would not reasonably expect it to inspect unrelated local documentation for tokens, so the behavior undermines informed consent and can lead to misuse of sensitive credentials.