ClawHub
Back to skill

Security audit

github-accelerator

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: private project names can reach public mirrors, and downloads can contact sites beyond the skill’s stated limits.

Keep private repositories and sensitive resources out of this workflow, even with a personal proxy configured: public mirrors remain fallback destinations. Verify downloads against an independently obtained official hash. Ask the publisher to enforce public-only fallback, restrict redirects, and reconcile configuration approval behavior. The supplied static scan reported no findings, but direct inspection confirms these boundary gaps; advisory claims of missing tool declarations and backdoor persistence are unsupported.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Section 5.1 says the script automatically creates a configuration template on first execution and supports a GH_ACCEL_CONFIG path override, conflicting with the declared approval requirement and fixed write scope. This supports a permission-boundary mismatch, but the script is not supplied, so the finding's additional claims about unchecked redirects, credential use, and private-repository fallback cannot be independently verified.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
scope: |
    Read-only GitHub transport fallback for public repositories.
    Network: GitHub hosts and configured mirror/proxy hosts only.
    Files: read downloads and clone destinations; write ~/.config/gh-accelerator/proxies.conf
    only after explicit user approval of the exact entries.
  prohibited:
    - Repository writes, pushes, or ref updates

The instructions exempt self-hosted proxies from the public-repository-only restriction.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The instructions exempt locally configured self-hosted proxies from the private-repository restriction and later allow sensitive resources through such proxies, despite the skill's public-only scope. Merely registering a proxy does not establish ownership or authorize disclosure of private repository identifiers or content, creating a confidentiality risk.

Content

No source excerpt is available for this finding.

The maintenance workflow directs edits to scripts and documentation outside the permitted file-write scope.

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

The maintenance workflow directs edits to script proxy arrays and documentation, although the declared write scope authorizes only the approved local proxy configuration. Following these instructions could persistently alter skill behavior and future network destinations without the required authorization; the maintenance context explains the edits but does not grant permission.

Content

No source excerpt is available for this finding.

The script creates the proxy configuration without the explicit approval required by the manifest.

Medium
Category
Excessive Agency
Confidence
100% confidence
Finding

The script automatically creates a configuration directory and file before dispatching any command, without the explicit approval required by the manifest. The template contains only comments, which limits immediate harm, but even a check operation causes an unauthorized persistent filesystem change; GH_ACCEL_CONFIG can also move that write outside the declared configuration path.

Content

No source excerpt is available for this finding.

Download redirects can contact hosts outside the declared GitHub and mirror allowlist.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The fetch helper uses curl -L, so validation of the initial GitHub URL does not constrain subsequent redirect destinations. A compromised or malicious mirror can redirect downloads to unapproved external hosts or reachable internal HTTP services, violating the network boundary and potentially saving attacker-controlled or internal response content as the requested artifact.

Content

No source excerpt is available for this finding.

Clone operations do not enforce the public-repository-only boundary before using GitHub credentials or third-party mirrors.

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The clone operation never verifies that the requested repository is public: direct GitHub cloning can use existing credential helpers to retrieve a private repository, while a failed direct attempt or --no-direct sends its identifier to third-party mirrors. This violates the public-only boundary and can disclose private repository names, although the shown code does not by itself establish that GitHub credentials are forwarded to a different mirror host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.