github-auth

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs accepting, reading, and embedding personal access tokens and other secrets verbatim into commands and URLs (e.g., echo "<THEIR_TOKEN>" | gh auth login, embedding https://:@github.com/..., extracting tokens from ~/.git-credentials), requiring the agent to handle secrets directly and expose them in output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly calls and parses public GitHub endpoints (e.g., SKILL.md curl examples to https://api.github.com/user and the scripts/gh-env.sh which runs curl and gh auth status and reads git remote URLs and ~/.git-credentials), so it ingests untrusted, user-generated third-party content (GitHub API/remote repo data) that is used to decide auth methods and subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs the agent to modify local SSH and git configuration (e.g., ~/.ssh/config, global git config), generate and store credentials (including plaintext ~/.git-credentials or embedded tokens), and extract tokens from files—actions that change the machine's authentication state and can expose secrets (so it's state-changing and security-sensitive) even though it doesn't request sudo or create users.