ClawHub
Back to skill

Security audit

analyze-ci

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow CI-failure analysis helper, but users should remember it may use GitHub credentials and send CI logs to Claude.

Install only if you trust the separate `uv run skills analyze-ci` implementation in your environment. Use a least-privilege GitHub token where possible, avoid running it on logs that may contain secrets unless sharing them with Claude is acceptable, and avoid `--debug` unless you need token and cost details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises that it analyzes failed GitHub Action jobs and explicitly mentions auto-detecting a GitHub token, but it does not warn users that CI logs may contain sensitive data and may be transmitted to Claude for analysis. CI logs frequently include secrets, internal paths, stack traces, environment details, or accidentally exposed credentials, so omission of this warning can lead users to disclose sensitive information without informed consent.

Static analysis

No suspicious patterns detected.