Security audit

GitHub API 工具

Security checks across malware telemetry and agentic risk

Overview

This is a scoped maintainer workflow skill for ClawHub GitHub PR and issue review, with state-changing actions disclosed and aligned to that purpose.

Install this only if you want the agent to assist with ClawHub maintainer workflows and you are comfortable with it using your existing GitHub authority for comments, proof publication, labels, or close decisions. Review proposed GitHub writes before allowing them, especially merges, closures, workflow dispatches, or bulk actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents write-capable GitHub actions such as creating issues, merging PRs, closing issues, and dispatching workflows without explicit warnings or confirmation requirements. In an agent context, this can normalize destructive or state-changing operations and increase the likelihood of unintended modifications to repositories, workflows, or project history when a user does not fully appreciate the impact.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.