ClawHub
Back to skill

Security audit

GitHub PAT Debugging

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because its troubleshooting workflow may make remote repository changes without clear user authorization; scan coverage is partial.

Consider the reported risk of unintended repository changes before installing. Scan coverage is partial: although both listed Markdown components were scanned, several references could not be resolved, so the results do not establish that all referenced material was reviewed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: github-pat-debugging
slug: github-pat-debugging
displayName: GitHub PAT Debugging
description: 排查 GitHub PAT 认证失败、401、Bad credentials、推送失败、token 看起来失效等问题。先检查命令、变量传递、路径和请求参数，再用 curl、Node、Python 或 PowerShell 交叉验证，确认后才判断权限、撤销或网络原因。适用于 GitHub API、Contents API、GitHub Pages 和 Skill 镜像推送。 Diagnose GitHub Personal Access Token failures before declaring a token expired or revoked.
description_zh: GitHub PAT 认证排障
description_en: Debug GitHub PAT failures
version: "1.0.6"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

  1. Test the same token with an independent client. In Bash, use direct expansion for curl:
    bash
    TOKEN=$(cat "$HOME/.workbuddy/connectors/default/tokens/github.txt")
curl -sS -D - -o /dev/null \\
  -H "Authorization: Bearer $TOKEN" \\
  -H "User-Agent: workbuddy-probe" \\
  -H "Accept: application/vnd.github+json" \\

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

-H "Authorization: Bearer $TOKEN" \ -H "User-Agent: workbuddy-probe" \ -H "Accept: application/vnd.github+json" \ https://api.github.com/user

text
4. When handing the token to a child process, export it explicitly. This is a critical Bash distinction:
- Wrong for a later command: `TOKEN=$(cat file) && node script.js` (shell variable is not exported).

The diagnostic workflow instructs the agent to modify a remote repository without warning the user that troubleshooting will create a repository change.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

Step 9 unconditionally moves from authentication troubleshooting to updating a remote file, without requiring an authorized write task or confirmation of the target and content. An agent following this workflow could make unintended repository changes or trigger deployment automation; retrieving the current SHA prevents stale updates but does not establish authorization.

Content

No source excerpt is available for this finding.

The workflow instructs token revocation without warning that dependent clients or integrations may lose access.

Medium
Category
Output Handling
Confidence
87% confidence
Finding

The decision tree directs the agent to revoke unused tokens but does not warn that revocation invalidates credentials and can interrupt automation or integrations still using them. It also does not explain how to establish that a token is genuinely unused before revoking it.

Content

No source excerpt is available for this finding.