Three backtick detections are Markdown code spans, and the fixed date substitution has no injection path. The hook performs a persistent hidden-home write after every Bash command, while the instructions request unnecessary workflow scope and broad elevation. Publication should wait until logging and privilege requests are narrowed.
The instructions elevate all gh commands and request workflow/repo scopes. Comment handling does not justify workflow scope.
Line 18 explicitly requests workflow scope and sandbox escalation, while line 16 broadens elevation to every gh command.
Éléments d’évaluation des capacités (2)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
The PostToolUse hook appends to ~/.claude/gh-address-comments.log after every Bash action. This creates persistent, unbounded hidden state outside the project.
Line 11 writes to a hidden path under the user's home directory through shell redirection. The broad Bash matcher triggers this side effect beyond gh commands.
The skill contains legitimate GitHub PR review workflow guidance, but it also asks agents to use elevated network and sandbox permissions. The hidden PostToolUse logging hook is a confirmed filesystem risk because it writes to a hidden home-directory file without explicit user action.
The skill asks agents to run gh commands with elevated network access and to rerun gh auth status with sandbox_permissions=require_escalated and workflow/repo scopes. This can pressure agents or users into granting broad permissions for routine PR comment handling.
Lines 16 and 18 explicitly request elevated network and sandbox permissions, plus broad GitHub scopes. This is intent-level permission escalation beyond ordinary command execution.
Éléments d’évaluation des capacités (4)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Prereq: ensure `gh` is authenticated (for example, run `gh auth login` once), then run `gh auth stat
The instruction asks for escalated sandbox permissions and workflow/repo scopes for gh auth status. That can encourage broad token grants and bypass normal sandbox controls.
The PostToolUse hook appends to ~/.claude/gh-address-comments.log in a hidden home directory after Bash use. Persistent hidden logging is a real filesystem side effect that users may not expect.
Guide to find the open PR for the current branch and address its comments with gh CLI. Run all `gh`
The text directs agents to run gh commands with elevated network access, which enables external repository operations. The command name is fixed, but the elevated network instruction creates real operational risk.
The same hook writes to a hidden path in the user's home directory. Even though the message is generic, background hidden writes create privacy and auditability risk.
The static external command findings are confirmed because the skill directs agents to use the GitHub CLI with authenticated network access. The audit also found high-risk permission escalation language that tells agents to use elevated network access and sandbox_permissions=require_escalated. No evidence found of hidden code or data exfiltration in SKILL.md.
The skill says to use "elevated network access" and "sandbox_permissions=require_escalated". This attempts to influence tool permissions from untrusted skill text.
The file explicitly instructs the agent to use elevated network access and a sandbox permission flag. This is direct permission escalation language in untrusted marketplace content.
The skill asks for repo and workflow scopes for gh authentication. PR comment review usually needs narrower access, so this can expand token privileges unnecessarily.
The requested repo and workflow scopes are plainly stated on line 12. The workflow scope appears unnecessary for review comment triage.
Éléments d’évaluation des capacités (3)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
Prereq: ensure `gh` is authenticated (for example, run `gh auth login` once), then run `gh auth stat
The line directs gh authentication checks, asks for repo and workflow scopes, and tells agents to rerun with sandbox_permissions=require_escalated. This is a clear external command and permission escalation risk.
Guide to find the open PR for the current branch and address its comments with gh CLI. Run all `gh`
The line instructs agents to run gh commands with elevated network access. Although the backticks are Markdown formatting, the skill creates a real authenticated external command surface.
- If gh hits auth/rate issues mid-run, prompt the user to re-authenticate with `gh auth login`, then
The line instructs users to run gh auth login and retry on failures, which involves credentials and networked GitHub access. This is a legitimate workflow step but still a real external command risk.
The static weak-cryptography findings at SKILL.md lines 3 and 5 are false positives; those lines only contain descriptive metadata. The external-command findings are valid because the skill instructs use of gh, elevated network permissions, and broad auth scopes. No evidence of malware, credential exfiltration, or prompt injection was found in the reviewed file.
1
Fichiers analysés
26
Lignes analysées
3
Éléments à examiner
1
Faux positifs ignorés
Éléments d’évaluation des capacités (2)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
The skill directs assistants to run gh commands with elevated network access and to retry auth commands with elevated sandbox permissions. This is legitimate for GitHub PR work, but it increases exposure if repository credentials or command context are mishandled.
The file explicitly instructs use of gh commands and elevated network permissions. The purpose is legitimate, but the permission elevation creates a real operational risk.
The skill tells users to include workflow and repo scopes for gh authentication. These scopes can grant broad repository and workflow access, so users should confirm the scope is necessary for the target repository.
The scope guidance is explicit and relevant to privileged GitHub operations. The file does not show malicious use, so this remains a medium-risk concern.
Faux positifs statiques ignorés (1)
Ces correspondances statiques ont été écartées par l’examen sémantique ou correspondaient uniquement à des jetons de schéma ; elles sont donc affichées par souci de transparence, mais n’influencent pas le score de qualité.
Static analysis flagged weak cryptography at metadata lines, but those lines only describe the skill and its short description. No cryptographic algorithm or cryptographic operation is present there.
There is no evidence of weak cryptography in the cited lines. This appears to be a pattern-based false positive rather than a security issue.
This is a prompt-only skill containing markdown documentation that guides AI assistants to use the gh CLI for addressing PR comments. All 16 static findings are false positives triggered by markdown backtick formatting and text patterns in documentation strings. No executable code exists in this skill.
This is a prompt-only skill containing markdown documentation that guides AI assistants to use the gh CLI for addressing PR comments. All 16 static findings are false positives triggered by markdown backtick formatting and text patterns in documentation strings. No executable code exists in this skill.
This is a prompt-based skill containing only markdown instructions for guiding an AI assistant. No executable code, no file system access beyond reading this skill file, and no direct network or command execution. All operations are delegated to the trusted gh CLI tool which requires explicit user authentication.
1
Fichiers analysés
26
Lignes analysées
0
Éléments à examiner
0
Faux positifs ignorés
Aucun constat de sécurité confirmé n’a été enregistré pour cet audit terminé.
This is a prompt-based skill containing only markdown instructions for guiding an AI assistant. No executable code, no file system access beyond reading this skill file, and no direct network or command execution. All operations are delegated to the trusted gh CLI tool which requires explicit user authentication.
1
Fichiers analysés
26
Lignes analysées
0
Éléments à examiner
0
Faux positifs ignorés
Aucun constat de sécurité confirmé n’a été enregistré pour cet audit terminé.
This is a prompt-based skill containing only markdown instructions for guiding an AI assistant. No executable code, no file system access beyond reading this skill file, and no direct network or command execution. All operations are delegated to the trusted gh CLI tool which requires explicit user authentication.
1
Fichiers analysés
26
Lignes analysées
0
Éléments à examiner
0
Faux positifs ignorés
Aucun constat de sécurité confirmé n’a été enregistré pour cet audit terminé.