Security audit

GitHub 智能代码审查与 CI/CD 自动化

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can post to pull requests and generate CI/CD workflow files without clear opt-in safeguards.

Install only if you are comfortable with the skill using your authenticated GitHub CLI context. Before running it, require a local preview of review output and generated workflow files, confirm before any PR comment is posted, and review generated .github/workflows files before committing or enabling them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: workflow.json:46
Finding: Untrusted pull-request content is processed as Agent instructions without isolation
Content: View full analysis
--repo --json title,body,files,additions,deletions,author,state", "gh pr diff --repo > pr-diff.txt", "gh api repos///commits?per_page=5 --jq '.[].sha'", "gh workflow list --repo " ], "output": { "pr_title": "PR 标题", "pr_description": "PR 描述", "changed_files": "变更文件列表", "lines_added": "新增行数", "lines_deleted": "删除行数", "author": "作者", "current_ci_status": "当前 CI 状态" } }, { "stage_2": { "name": "AI 代码审查", "skill": "quack-code-review", "actions": [ "读取 pr-diff.txt 内容", "分析代码变更，检测 bug/安全/逻辑问题", "输出结构化审查报告" ], ``` The same unsafe processing model is documented in `SKILL.md:40-64`, where pull-request metadata and diffs are collected and then submitted for AI analysis. ### Technical Analysis Pull-request titles, descriptions, filenames, and diffs can be controlled by an untrusted contributor. The workflow retrieves these values and instructs the AI review stage to read the resulting diff without defining a trust boundary or directing the Agent to ignore instructions embedded in repository content. Consequently, prompt-like text placed in a pull-request description, source file, comment, string literal, filename, or diff could be interpreted as an instruction rather than as data under review. For example, malicious content could direct the reviewer to suppress findings, produce attacker-selected workflow definitions, disclose contextual information, or request unintended tool operations. The risk extends into the subsequent workflow-generation stage. If manipulated review output is treated as trusted input, it can influence generated GitHub Actions files or content posted to a pull request. # ...[truncated 1453 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: workflow.json:99
Finding: Shell command templates interpolate untrusted values without defined validation or safe argument handling
Content: View full analysis
--repo --body " ] }, ``` Related command templates also appear at `workflow.json:46-49`: ```json "actions": [ "gh pr view --repo --json title,body,files,additions,deletions,author,state", "gh pr diff --repo > pr-diff.txt", "gh api repos///commits?per_page=5 --jq '.[].sha'", "gh workflow list --repo " ], ``` Equivalent command guidance is documented in `SKILL.md:40-49` and `SKILL.md:134`. ### Technical Analysis The workflow represents GitHub operations as shell command strings containing placeholders for repository identifiers, pull-request numbers, and generated review content. No validation rules, escaping requirements, or safe process-invocation mechanism are specified. The most sensitive case is the use of `` directly after `--body`. Review output can contain whitespace, quotes, shell metacharacters, substitutions, or multiline text. If an executor implements these templates through textual replacement followed by a shell, specially crafted content could terminate the intended argument and introduce additional shell syntax. Repository identifiers and pull-request values can present a similar risk if they are accepted from user input without strict validation. The redirection to a fixed `pr-diff.txt` also lacks requirements for secure temporary-file creation, isolation, or cleanup. The repository contains configuration and documentation rather than the command runner itself. Exploitability therefore depends on whether the hosting framework executes these strings through a shell and performs raw placeholder substitu ...[truncated 1260 chars]
Remediation: View remediation
` instead of interpolating the report into `--body`. 6. Create temporary files with unpredictable names and owner-only permissions; avoid a shared fixed filename such as `pr-diff.txt`. 7. Ensure temporary files are removed in a guaranteed cleanup block. 8. Prevent option injection by rejecting values beginning with `-` and by using option terminators where supported. 9. Construct GitHub API endpoints from separately validated path components rather than unchecked text. 10. Add tests containing quotes, command substitutions, newlines, semicolons, redirections, and leading-dash values to verify that every value remains a single inert argument. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes generating GitHub Actions workflow files, which changes repository configuration and can alter CI/CD execution behavior. In the context of an automation skill, creating or recommending workflow files without prominent warnings or approval gates can lead to unintended pipeline execution, secret exposure through misconfigured workflows, or disruptive changes to build and deployment processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that the agent will write review results back to PR comments, which is a remote side effect on a live repository collaboration surface. Without an explicit warning, confirmation step, or clear separation between read-only analysis and write actions, users may trigger unintended repository modifications, spam PR discussions, or expose sensitive analysis output publicly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are very broad (e.g. '代码审查', '生成 CI/CD', '代码质量检查') and lack clear activation boundaries such as explicit user confirmation, repository scope, or safe-mode defaults. In an agent environment, this can cause unintended invocation on ordinary developer requests and lead to automated repository reads, PR commenting, or workflow generation without the user clearly intending those actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill does not clearly warn users that it may post automated PR comments and generate or modify GitHub Actions workflow files, both of which are repository-affecting operations. Because CI/CD workflows can influence build, test, deployment, and security behavior, a user may invoke the skill expecting analysis only and unintentionally authorize impactful changes to project automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic phrases such as "代码审查", "PR review", and "代码质量检查", which are broad enough to match ordinary user requests outside a clearly scoped GitHub automation context. Because this skill can lead to repository-affecting follow-on actions like PR commenting and workflow generation, unintended invocation could cause the agent to collect repo data or propose/perform automation when the user did not explicitly request this specific skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes generating GitHub Actions workflow files and posting PR comments, but it does not include an explicit warning or user-consent step for repository-modifying or externally visible actions. In a CI/CD context, generated workflows can change build, deployment, or security-scan behavior, and PR comments can leak analysis output into shared project spaces, so users need clear notice and confirmation before these actions occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The entire skill description and example invocations are presented only in Chinese, which can constitute a language policy issue when no user opt-in or locale justification is provided. There is no indication that the skill supports language selection or is intentionally limited to Chinese-speaking users for a documented reason.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.