Skill Github Daily Ops

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.1

Overview

This skill is a legitimate GitHub operations helper, but it can merge repository changes and includes an under-disclosed script that can push local workspace commits.

Install only if you want GitHub automation that can change repositories. Use report-only mode first, provide a fine-grained token limited to intended repos, avoid scheduling --merge-dependabot until the CI and severity gates are tightened, and do not run daily-ops.sh unless you explicitly accept its workspace push behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly relies on sensitive environment data such as GITHUB_TOKEN and GITHUB_ORG, but no permissions are declared in the skill manifest. That creates a trust and review gap: operators cannot easily see that the skill consumes credentials, and runtimes may grant broader access than intended. In a security-sensitive automation context, undeclared credential usage increases the risk of accidental secret exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior says the skill performs reporting and 'safe' Dependabot auto-merge, but the detected behavior includes pushing commits, inspecting local repositories beyond the described scope, and deleting branches during merge. This mismatch is dangerous because users may authorize or schedule the skill expecting read/report actions, while it can make destructive or externally visible repository changes. In unattended cron use with a GitHub token, that hidden write behavior materially raises the risk of unauthorized repository modification and supply-chain impact.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script performs `git push` on a local workspace, which exceeds the stated scope of a GitHub health check and Dependabot auto-merge tool. This creates an unexpected write capability that can publish local commits to a remote repository without explicit approval, increasing the risk of accidental data exposure or unauthorized code deployment.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script silently reads credentials from `~/.github_token`, which is a sensitive local secret source. Even if used only for GitHub API access, automatically loading a token from disk broadens the skill's privilege use and can surprise users who did not intend this skill to consume local credentials.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The header describes the script as producing a markdown report, but the implementation also merges pull requests and pushes commits. This mismatch is dangerous because users may grant execution assuming read-only/reporting behavior when the script actually performs write operations against repositories.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs an automatic merge operation on live repositories once its CI heuristic deems checks green, without any human approval gate, dry-run mode, or explicit repository allowlist confirmation at execution time. In the context of an agent skill, this is security-relevant because a compromised or mistaken Dependabot PR, weak check policy, or misidentified safe PR can result in unintended code being merged directly into protected branches.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script can merge Dependabot pull requests as soon as the --merge-dependabot flag is supplied, without any interactive confirmation, dry-run safeguard, allowlist, or branch/repository protection checks in the script itself. In an agent skill context, this is more dangerous because a higher-level automation or mis-specified prompt could trigger repository-changing actions across many repos, causing unintended dependency updates, broken builds, or merging unreviewed changes at scale.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Reading a GitHub token from a local file without prominent warning or consent can lead to unintended secret use and privileged API actions. In this script, that risk is amplified because the same token is then used for repository mutations such as PR merges.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script auto-merges Dependabot PRs solely based on CI status, with no explicit user confirmation and no additional policy checks such as target branch, allowed update type, required reviews, or repository allowlisting beyond the hardcoded list. Automatic merging is a state-changing action that can introduce breaking or risky dependency changes if CI is insufficient or compromised.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script pushes unpushed local commits to the remote repository without prior confirmation. This can unintentionally publish sensitive, experimental, or unreviewed local changes, especially since `WORKSPACE` is configurable and may point to any git repository on the host.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.