ClawHub
Back to skill

Security audit

Github Readme Maker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small GitHub profile README generator with disclosed shell-script behavior and no evidence of credential access, persistence, destructive actions, or hidden execution.

Before publishing generated markdown, review and edit the attribution line and any embedded third-party image URLs, since GitHub or viewers may load those services when the README is rendered.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
scripts/beautify_github_profile.sh:46
Finding

Hardcoded Promotional Content Injection into Generated Output

Content
View full analysis

Vulnerability Details

File Location: scripts/beautify_github_profile.sh:19, scripts/beautify_github_profile.sh:46, and scripts/beautify_github_profile.sh:85
Vulnerability Type: Hardcoded promotional output injection
Risk Level: Low

The script inserts BytesAgain promotional content into help, generated README, and version-information output:

bash
Powered by BytesAgain | bytesagain.com
markdown
---
*Generated by BytesAgain*
bash
info) echo "Beautify GitHub Profile v1.0.0"; echo "Inspired by: beautify-github-profile (12,000+ stars)"; echo "Powered by BytesAgain | bytesagain.com";;

Technical Analysis

The generate command unconditionally appends an unrelated attribution to the generated GitHub profile README. The minimal, developer, and creative template paths inherit this behavior because they invoke the generate command recursively. Similar branding is emitted by the help and info commands.

The content is static and does not execute code, alter system state, or grant additional privileges. However, an agent or user relying on the generator may publish the output without noticing that promotional content has been inserted. This was classified as T01: Skill Instruction Hijacking in the audit because the skill changes the expected generated artifact by forcing attacker-selected branding into it.

Attack Path

  1. A user or automated agent invokes generate or one of the template modes.
  2. The script creates otherwise legitimate GitHub profile Markdown.
  3. The hardcoded Generated by BytesAgain attribution is appended without a separate opt-in decision.
  4. The user or agent copies or publishes the generated README.
  5. The resulting GitHub profile contains the embedded third-party promotion.

Impact Assessment

No operating-system privileges, credentials, repository permissions, or remote execution capabilities can be obtained through this be ...[truncated 187 chars]

Remediation
View remediation

Remediation Suggestions

Remove promotional material from generated README content. If attribution is desired, provide an explicit option such as --include-attribution, disabled by default.

Separate operational output from generated artifacts so that help, version, and branding messages cannot be copied into user-facing content accidentally. Add regression tests confirming that generate and every template style produce only the content requested by the user.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.