Developer Workflow Automation

• Outcome: Review
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This GitHub skill is mostly legitimate, but it can make persistent GitHub changes with broad token authority and does not fully disclose or gate every write action.

Install only if you intend to let an agent write to your GitHub account. Use the narrowest possible GitHub token, prefer public-only or fine-grained permissions when possible, and manually confirm repo names, visibility, issue content, branches, and pull-request targets before allowing mutating actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill requires sensitive environment variables and performs networked GitHub operations, but the manifest does not declare explicit permissions for those capabilities. This weakens governance and user awareness, making it easier for a skill with write-capable credentials to access secrets and perform outbound actions without clear permission scoping.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared description emphasizes querying and managing repositories in limited ways, but the detected behavior includes higher-risk actions such as creating repositories, creating pull requests, and fetching arbitrary owner/repo details. This mismatch can mislead users about the scope of authority and lead to unintended destructive or externally targeted actions when the skill is invoked.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The declared API surface exposes state-changing capabilities to create repositories and pull requests, but the manifest description only advertises querying/managing repositories, listing repos, checking CI, creating issues, searching repos, and viewing activity. This mismatch can mislead users or higher-level policy layers about the skill's true authority, increasing the risk of unintended write actions against GitHub resources.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code exposes `createRepo` and `createPullRequest` capabilities even though the declared skill description only mentions querying/managing repositories at a higher level and does not clearly disclose those write operations. Hidden or under-declared write capabilities increase the chance that users or orchestrators invoke destructive or security-relevant actions without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README advertises `Create Issues` and `Create Repos` as normal features but does not clearly warn that these actions make persistent changes to the user's remote GitHub account. In an agent skill context, failing to distinguish read-only operations from write operations increases the risk of unintended repository creation or issue spam if the assistant acts on ambiguous prompts.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README states that the skill automatically uses authenticated GitHub credentials but does not clearly warn users that repository and account metadata will be transmitted to GitHub APIs using their token. This is a privacy/transparency gap rather than an exploit primitive, but it matters because users may not realize the scope of data disclosure when querying private repositories.

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The example trigger phrases are generic enough to overlap with ordinary conversation, increasing the chance the skill activates when the user did not intend a GitHub action. Because the skill can perform write operations such as issue or repository creation, accidental triggering can cause unintended changes to remote resources.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The module automatically attaches a GitHub token to outbound requests with no visible user-facing disclosure or scope check in this file. In an agent setting, silent credential use is risky because higher-level prompts or tools may trigger authenticated requests the user did not realize would be sent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `createIssue` performs a remote state-changing action on GitHub without any confirmation, policy check, or dry-run mode in this code path. In an agentic environment, this can lead to unwanted issue spam, disclosure of sensitive content in issue bodies, or abuse of the authenticated account.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: `createRepo` can create new repositories remotely without an explicit confirmation barrier or policy restriction. Repository creation is more sensitive than read operations because it can create public attack surfaces, leak naming intent, consume organizational resources, or create repos with unsafe visibility defaults if misused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `createPullRequest` creates a remote write action that can alter collaboration workflows, trigger CI, and expose code/content to maintainers without any user-facing confirmation in this file. In agent workflows, silent PR creation can be abused for spam, social engineering, or unintended publication of branch contents.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This skill exposes state-changing GitHub operations such as creating repositories, issues, and pull requests directly through action handlers, and this file shows no built-in confirmation, approval gate, or safety warning before those operations can be invoked. In a conversational agent context, that increases the risk of prompt-induced or accidental actions being executed against the user's GitHub account, causing unauthorized changes, spam, or workflow disruption.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.