One-click installation of GitHub projects

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent GitHub installer wrapper, but it asks agents to run an unpinned external CLI that can install dependencies and run repository scripts, including non-interactive modes.

Review this skill before installing. Use it only with repositories and a `ginstall` binary you trust, prefer plan-only or guided review before execution, avoid `--yes` on unfamiliar repositories, and provide a minimally scoped `GITHUB_TOKEN` only when private repository access is necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned and inconsistently identified external executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10, SKILL.md:28, SKILL.md:40-50, SKILL.md:85-89, and README.md:17
Vulnerability Type: Unverified third-party executable and inconsistent supply-chain source
Risk Level: Medium

Vulnerable Code

SKILL.md:8-10 identifies one upstream source:

yaml

metadata:
  openclaw:
    requires:
      bins: [node, git]
    homepage: https://github.com/ginstall-oneclick/ginstall-oneclick

SKILL.md:28 accepts an unspecified executable from the system PATH:

markdown

- **`ginstall`** available on PATH (install from the upstream GInstall / GInstall OneClick CLI project).

SKILL.md:40-50 invokes that executable, including an auto-approved execution mode:

markdown

3. **Run `ginstall` with quoted repo URL** — prefer:

```bash
ginstall "<repo-url>" --mode guided --env-mode scan

CI / non-interactive:

bash

ginstall "<repo-url>" --yes --mode assisted --env-mode scan

text

`SKILL.md:85-89` identifies a different GitHub owner as the upstream source:

```markdown
## Upstream CLI

This file is the **OpenClaw skill** only. Install or build **`ginstall`** from the GInstall OneClick CLI repository:

<https://github.com/YunzhouLi-hub/GInstall-OneClick>

README.md:17 again points to the first repository:

markdown

| [**`ginstall` CLI**](https://github.com/ginstall-oneclick/ginstall-oneclick) | Does clone, installs, scripts (this skill teaches the agent **how** to call it). |

Technical Analysis

The Skill delegates its security-sensitive functionality to whichever executable named ginstall appears first on PATH. It provides no pinned release, commit identifier, package version, checksum, signature verification, or deterministic installation procedure.

The documented source is also inconsistent: the metadata and README reference `github.com/ginstall-oneclick/ginstall-o ...[truncated 2486 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish one canonical upstream source

   • Determine the authoritative repository.
   • Make the frontmatter homepage, README requirement, and upstream CLI section reference the same repository.
   • Remove or explain any legacy or mirror URLs.

2. Pin the trusted release

   • Require a specific semantic version and, where practical, an immutable release commit.
   • Avoid instructions that install from a moving branch such as main.
   • Review and deliberately approve upgrades before changing the pinned version.

3. Verify artifact integrity

   • Publish cryptographic checksums or signed release artifacts.
   • Verify the checksum or signature before first execution.
   • Document a deterministic installation command tied to the pinned artifact.

4. Validate the executable before invocation

   • Resolve the executable using a trusted absolute path rather than an arbitrary PATH entry.
   • Check its version and provenance.
   • Reject unexpected binaries or versions instead of continuing automatically.

5. Minimize the child process environment

   • Do not expose GITHUB_TOKEN for public repositories.
   • Provide the token only to the operation that requires private GitHub access.
   • Remove unrelated secrets from the spawned process environment.
   • Continue requiring a minimally scoped, read-only token.

6. Contain execution

   • Run installation and project scripts in an isolated workspace or container.
   • Use an unprivileged account with restricted filesystem access.
   • Apply outbound network restrictions where operationally feasible.
   • Avoid --yes for untrusted repositories and present the execution plan for approval before dependency or development scripts run.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to run a tool that will clone a repository, install dependencies, and start development scripts, but it does not clearly warn that these steps may execute untrusted code from the target repository. In this context, omission of that warning is security-relevant because npm install hooks and dev/start scripts are a common code-execution path and users may interpret this as a routine safe setup action.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The skill documents and encourages non-interactive auto-approval modes such as --yes and assisted/auto flows for a tool that can clone code, install dependencies, scan environment data, and run dev scripts. Removing interactive checkpoints increases the chance that unreviewed repository actions and environment exposure happen without meaningful user consent, especially when targeting arbitrary GitHub URLs.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

| Flag / env | Role |
|------------|------|
| `--yes`, `CI`, `GINSTALL_NON_INTERACTIVE`, `GINSTALL_YES` | Non-interactive; auto-approve steps |
| `--mode` / `GINSTALL_MODE` | `manual` \| `guided` \| `assisted` \| `auto` |
| `--env-mode` / `GINSTALL_ENV_MODE` | `manual` \| `scan` \| `plan` |
| `--run-timeout` / `GINSTALL_RUN_TIMEOUT` | Dev/run step cap (seconds) |

Static analysis

No suspicious patterns detected.