ClawHub
Back to skill

Security audit

Agent GitHub Workflow

Security checks across malware telemetry and agentic risk

Overview

This GitHub skill looks legitimate, but it can use your token to create repositories, issues, and pull requests without built-in confirmation and does not fully disclose every write action.

Install only if you are comfortable giving this skill a GitHub token that can modify repositories. Prefer a fine-grained token limited to specific repositories, avoid broad classic repo scope where possible, manually confirm the exact owner, repo, visibility, title, body, branches, and target before write actions, and set private=true when creating repositories unless public creation is intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares required environment variables and clearly depends on network access, yet it does not declare explicit permissions or guardrails for those capabilities. In an agent setting, undeclared env and network access reduces transparency and can let a seemingly simple integration access secrets and make outbound requests without clear user consent boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The description emphasizes querying and managing repositories with examples centered on listing, status checks, and issue creation, but the detected behavior also includes creating repositories and pull requests. That mismatch is dangerous because users may authorize a read-oriented GitHub helper without realizing it can perform materially broader write actions that change repository state.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The declared API surface includes state-changing capabilities to create repositories and pull requests, but the manifest description only mentions querying/managing repos, listing repos, checking CI, creating issues, searching repos, and viewing activity. This mismatch can mislead users or policy systems about the skill’s true privileges, increasing the risk of unintended write actions against GitHub resources when the skill is granted authenticated access.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill metadata understates the actual capabilities by omitting repository creation and pull-request creation, both of which are state-changing GitHub operations. This can mislead users or higher-level agents into granting or invoking the skill under the assumption that it is read-oriented, increasing the risk of unexpected remote modifications.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The exported skill description says only 'Query and manage GitHub repositories', while the actual actions include create_repo and create_pull_request, which are materially more sensitive than passive querying. This mismatch can mislead users, orchestrators, or policy layers into granting or invoking broader write-capable functionality than expected, increasing the chance of unintended repository or workflow changes.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The usage examples rely on broad natural-language requests like creating issues or checking a 'main project' without defining repository scope, ownership constraints, or confirmation requirements. In an autonomous assistant, vague triggers can cause unintended actions against the wrong repository or on stale conversational context, especially for write operations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
createIssue performs a remote write to GitHub using authenticated credentials without any visible confirmation, approval step, or user-disclosure mechanism in this module. In an agent setting, that enables unintended issue creation, spam, data leakage into public trackers, or misuse of the user's account if prompts are ambiguous or adversarial.

Missing User Warnings

High
Confidence
96% confidence
Finding
createRepo creates a new GitHub repository as the authenticated user with no built-in confirmation or warning, which is a higher-risk remote write than issue creation because it can create persistent public or private assets. In an agent environment, this can be abused to create unauthorized repositories, expose project names/metadata, or clutter an account through prompt injection or accidental invocation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
createPullRequest opens a pull request on a remote repository without any visible confirmation or guardrails, which changes workflow state and may trigger notifications, CI jobs, or review processes. In the GitHub skill context this is particularly sensitive because PRs can be created from model-supplied branches and text, enabling unintended submissions or social engineering through the user's account.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This file exposes state-changing GitHub actions such as create_repo, create_issue, and create_pull_request directly through handlers, but there is no visible confirmation, warning, or friction for these operations at the skill definition layer. In an agentic context, that makes accidental or prompt-induced writes to GitHub more likely, which can create spam issues, unwanted repositories, or unauthorized pull requests using the connected account.

Session Persistence

Medium
Category
Rogue Agent
Content
You: Check CI status on my main project
Bot: [shows CI/CD status]

You: Create an issue about the bug
Bot: [creates the issue]
```
Confidence
74% confidence
Finding
Create an issue about the bug Bot: [creates the issue] ``` ## Setup ### 1. Generate GitHub Personal Access Token 1. Go to https://github.com/settings/tokens 2. Click "Generate new token (classic)"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.