github-pr-knowledge-wiki-sync

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it automatically moves PR and code-change content into external documentation systems and uses unsafe, weakly scoped inputs for commands and file output.

Install only if you are comfortable with PR titles, descriptions, file lists, diffs, and generated summaries being processed and written to Feishu, WeCom, or local files. Prefer using it on trusted repositories, review the generated document before publication, verify the destination workspace, and avoid PRs that may contain secrets, private architecture details, or security-sensitive changes until the workflow adds input validation and publish confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: workflow.json:22

Finding

Shell Command Injection Through Unvalidated PR URL Components

Content

View full analysis

Vulnerability Details

File Location: workflow.json, lines 22 and 41
Vulnerability Type: OS command injection through unsafe string interpolation
Risk Level: High

Vulnerable Code

json

"command": "gh pr view ${prNumber} --repo ${owner}/${repo} --json title,body,state,author,createdAt,mergedAt,files,commits,additions,deletions",

json

"command": "gh pr diff ${prNumber} --repo ${owner}/${repo} --no-color",

Technical Analysis

The workflow constructs shell command strings by directly interpolating prNumber, owner, and repo, which are derived from the user-supplied PR URL. The configuration does not define strict validation, shell escaping, or argument-array execution for these values.

If the github Skill passes the resulting command to a shell, an attacker can place shell metacharacters or command substitutions into a parsed URL component. The shell may then interpret part of the interpolated value as an additional command rather than as a literal GitHub identifier.

Exploitability depends on the workflow engine and github Skill using shell-based command execution. Nevertheless, the configuration establishes an unsafe command-construction boundary and provides no controls that would prevent command injection.

Attack Path

1. An attacker supplies a crafted value in the expected PR URL input.
2. The workflow extracts attacker-controlled text into owner, repo, or prNumber.
3. The extracted value is inserted directly into one of the command strings.
4. The github Skill executes the command through a shell.
5. Shell metacharacters or command substitutions are evaluated.
6. The injected command runs with the privileges and environment of the Agent process.

Impact Assessment

Successful exploitation could permit arbitrary command execution under the Agent's operating-system account. The attacker could read or modify files accessible to that account, access ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the PR URL using a strict URL parser and require the hostname to be exactly github.com or an explicitly approved GitHub Enterprise hostname.
2. Validate repository owners and names against a restrictive allowlist such as ^[A-Za-z0-9_.-]+$.
3. Require the PR number to match ^[0-9]+$ and convert it to an integer before use.
4. Execute gh directly with an argument array instead of constructing a shell command string.
5. If shell execution cannot be eliminated, apply context-appropriate shell escaping after validation; escaping must not replace validation.
6. Run the workflow in a minimally privileged sandbox with restricted filesystem and credential access.
7. Add negative tests covering semicolons, command substitution, newlines, option injection, traversal strings, and malformed URLs.

T09 · Insecure Skill Coding Practices

Warning

• Location: workflow.json:58

Finding

Indirect Prompt Injection Through Untrusted Pull Request Content

Content

View full analysis

Vulnerability Details

File Location: workflow.json, lines 58–60 and 77
Vulnerability Type: Indirect prompt injection and unsafe automated publication
Risk Level: Medium

Vulnerable Code

json

"input": {
  "diff": "${step2.diff}",
  "prTitle": "${step1.prTitle}",
  "prBody": "${step1.prBody}",
  "files": "${step1.files}"
},

json

"input": {
  "content": "请为以下 GitHub PR 生成完整的技术变更文档：\n\nPR 标题：${step1.prTitle}\nPR 描述：${step1.prBody}\n作者：${step1.author}\n状态：${step1.state}\n合并时间：${step1.mergedAt}\n\n变更文件：${step1.files}\n\n关键代码变更：${step3.keyChanges}\n风险点：${step3.riskPoints}\n影响范围：${step3.affectedAreas}",
  "format": "markdown",
  "style": "technical-documentation"
},

Technical Analysis

Pull request titles, descriptions, file contents, and diffs are repository-controlled data. A malicious contributor can place natural-language instructions inside these fields. The workflow sends this content directly to the code-review and summarize Skills without clearly separating it from trusted instructions or directing the model to treat embedded commands as inert data.

The resulting document is subsequently eligible for automatic publication to Feishu Wiki or WeCom. Consequently, prompt injection can cross a trust boundary from attacker-controlled repository content into an organizational documentation system.

The issue does not establish arbitrary host command execution by itself. Its primary effect is manipulation of AI-generated analysis and published documentation.

Attack Path

1. An attacker creates or modifies a pull request and inserts adversarial instructions into its body, title, filenames, comments represented in the diff, or source-code text.
2. The workflow retrieves the pull request description and complete diff.
3. The untrusted text is passed directly to code-review.
4. The PR body and model-generated analysis are then embedded directly in the summarization ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify PR metadata and diffs as untrusted data in every downstream model instruction.
2. Place untrusted fields in structured, strongly delimited sections and instruct models never to execute or follow instructions found inside those sections.
3. Separate trusted system instructions from repository content rather than concatenating both into one free-form prompt.
4. Add output validation that detects unexpected instructions, external links, hidden markup, credential requests, and claims unsupported by the source material.
5. Require human approval before publishing documents to Feishu Wiki or WeCom, especially for PRs from forks or untrusted contributors.
6. Sanitize rendered Markdown according to the destination platform's rules.
7. Preserve provenance by clearly identifying quoted PR content and linking each generated claim to relevant source changes.
8. Apply stricter handling or disable automatic publication when the PR originates from an untrusted repository or fork.

T09 · Insecure Skill Coding Practices

Warning

• Location: workflow.json:133

Finding

Unrestricted Local Output Path Allows Writes Outside the Intended Directory

Content

View full analysis

Vulnerability Details

File Location: workflow.json, line 133
Vulnerability Type: Path traversal and arbitrary file destination selection
Risk Level: Medium

Vulnerable Code

json

"path": "${input.output}/${prNumber}-pr-doc.md",

Technical Analysis

The destination path is assembled from the user-controlled input.output value and the derived prNumber without documented canonicalization, filename sanitization, or confinement to an approved output root.

An absolute output path or a path containing traversal components could resolve outside the intended project output directory. If the local Skill permits overwriting existing files, generated Markdown could replace an accessible file whose name matches the constructed suffix.

Exploitability and the exact overwrite scope depend on the local Skill's path handling and the filesystem permissions of the Agent process. The workflow itself does not impose a containment boundary.

Attack Path

1. An attacker selects the markdown output target.
2. The attacker supplies an absolute path or traversal sequence through input.output; a maliciously parsed PR number could further influence the filename.
3. The workflow concatenates these values without normalization or containment checks.
4. The local Skill resolves and writes to the resulting path.
5. The generated document is created outside the intended output directory or overwrites an existing accessible Markdown file.

Impact Assessment

Successful exploitation could create or overwrite files writable by the Agent account. This may corrupt project documentation, alter repository content, or place attacker-influenced Markdown in an unintended location.

The filename always includes the PR-derived suffix in the observed template, so the set of directly targetable files may be constrained. The effective scope is further limited by the local Skill's overwrite policy and the runtime account's ...[truncated 24 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a fixed, dedicated output root controlled by the application rather than accepting arbitrary filesystem destinations.
2. Resolve the requested path to its canonical form and verify that it remains beneath the approved output root.
3. Reject absolute paths, traversal components, symbolic-link escapes, null bytes, control characters, and platform-specific path separators where inappropriate.
4. Validate the PR number as digits only and derive the filename from the validated integer.
5. Open output files with exclusive creation or a safe no-overwrite policy unless replacement is explicitly authorized.
6. Use restrictive file permissions and run the local writer with least privilege.
7. Add tests for absolute paths, repeated traversal sequences, symbolic links, Windows drive paths, UNC paths, and existing-file collisions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill promotes automatic synchronization of PR content, code changes, and generated documentation to external platforms, but it does not warn users about privacy, confidentiality, or data propagation risks. In practice, PRs may contain proprietary code, internal URLs, security-relevant implementation details, or sensitive discussion that should not be copied into third-party knowledge systems without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly promotes an automated flow that takes PR-derived content and creates or updates documents in Feishu Wiki or WeCom without documenting any confirmation step, publication safeguards, or warnings about pushing content to external systems. This can lead to unintended disclosure of sensitive code, internal architecture details, or unreviewed/generated content into organizational knowledge bases, especially because the workflow is framed as a one-command end-to-end automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad natural-language expressions such as asking what a PR changed and to help generate documentation, which can cause the skill to activate unintentionally in normal conversation. Because the skill can fetch PR contents and sync generated documentation to external knowledge bases, accidental activation may lead to unintended data access and publication.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow summarizes PR titles, descriptions, file lists, and diff-derived analysis and then publishes the resulting document to external knowledge platforms without any content-sensitivity filtering. This is risky because PRs often contain confidential implementation details, internal URLs, credentials accidentally committed in diffs, or security-sensitive changes that should not be broadly redistributed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow automatically sends PR-derived content, including PR body, changed files, code-diff analysis, and generated summaries, to external destinations such as Feishu Wiki, WeCom Docs, or local files. Because there is no sensitivity classification, redaction, approval gate, or explicit disclosure/confirmation before publication, internal code details, secrets accidentally present in diffs, or sensitive design information could be propagated outside the original repository context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README presents the skill name, description, examples, and output preview entirely in Chinese, which implies a fixed language/locale behavior. There is no mention that users can choose another language or that the Chinese locale is a documented regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

L003-L005 以及后续使用说明均以中文描述触发方式和功能，没有表明是否支持其他语言或允许用户选择输出语言。若组织要求避免未经用户同意强制特定语言，这种默认中文且无选择说明的做法构成语言策略风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is entirely in Chinese and presents the workflow as operating in that language, while the manifest does not indicate that Chinese is optional or that the tool is region-specific. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The summarize step instructs document generation using a Chinese prompt, which effectively constrains output language to Chinese. The file provides no user-selectable language parameter and no documented reason for this locale restriction.

Content

No source excerpt is available for this finding.