Security audit
Security checks for vulnerabilities and agentic risk
This repository explorer can silently reuse a GitHub token from OpenClaw’s secrets file beyond the authentication setup it documents.
Before installing, remove the automatic ~/.openclaw/.env fallback and explicitly provide a dedicated GitHub token with minimal permissions. Keep the host secrets file inaccessible to the skill; dry-run mode still attempts credential lookup. All six bundled files were inspected statically, but runtime access controls were not tested. The empty static-scan results do not negate the credential behavior visible in the code.
The documentation describes authentication through explicitly supplied environment variables, but the implementation silently falls back to ~/.openclaw/.env when those variables are unavailable. This accesses host-managed credentials outside the skill directory and circumvents credential filtering; the legitimate GitHub use case does not authorize that additional access.
The fallback explicitly reads a host-level secrets file because the execution environment filters token variables, thereby defeating that credential boundary. The recovered token is used for GitHub authentication without explicit provisioning to this skill; no attacker-controlled exfiltration destination is shown, but unauthorized credential use is established.
Although this match occurs in a docstring, the adjacent implementation actually opens ~/.openclaw/.env and extracts GITHUB_TOKEN. The comment confirms that this is a workaround for filtered credentials, making it an unauthorized credential-access issue rather than a harmless mention of an environment file.
# ---------- GitHub API ----------
def _env_file_token() -> str:
"""从 ~/.openclaw/.env 读 GITHUB_TOKEN（OpenClaw exec 快照会过滤 token 类环境变量，故需文件回退）。"""
env_file = os.path.expanduser("~/.openclaw/.env")
try:
with open(env_file, "r", encoding="utf-8") as f:
This path is used to open a host-managed secrets file and recover a GitHub token whenever the designated environment variables are absent. It is the same underlying credential-boundary violation as the other fallback findings, not a separate demonstrated exfiltration mechanism.
def _env_file_token() -> str:
"""从 ~/.openclaw/.env 读 GITHUB_TOKEN（OpenClaw exec 快照会过滤 token 类环境变量，故需文件回退）。"""
env_file = os.path.expanduser("~/.openclaw/.env")
try:
with open(env_file, "r", encoding="utf-8") as f:
for line in f:
Without declared permissions the skill's intent is opaque and cannot be validated.
Line 7 requires strict adherence to a template containing Chinese headings, and line 41 explicitly requires the Chinese fallback text “README 未披露”. This makes Chinese-language output mandatory for those elements without offering a language choice or documenting a locale-specific justification.