Skill Trust Decision
skill-publisher
SKILL.md metadata and documentation directly contradict the actual implementation: metadata declares `requires_api_key: false` while `upload_to_github.py` contains a hardcoded GitHub Personal Access Token, and the SKILL.md only describes `clawhub` CLI / `gh` CLI / `git push` workflows — never mentioning the Python script that performs undeclared HTTP network access.
Most direct threat evidence
Critical Credential Theft
Hardcoded GitHub Personal Access Token A real GitHub PAT (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) is hardcoded in plaintext at upload_to_github.py:7. Any agent with filesystem:READ access to the skill directory can extract this token and use it to authenticate as the token owner on GitHub, enabling repository creation, file uploads, releases, and code manipulation under the owner's account.
upload_to_github.py:7 Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 4 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
Agent with filesystem:READ access reads upload_to_github.py from the skill directory
Entry · upload_to_github.py:7
02
Agent extracts hardcoded GitHub PAT (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) and BASE_DIR path
reconnaissance · upload_to_github.py:7
03
Agent uses PAT to authenticate with GitHub API as the token owner (EdwardWason)
Persistence · upload_to_github.py:15
04
Agent creates/modifies repositories, uploads files, creates releases, or exfiltrates repository contents under EdwardWason's account
Impact · upload_to_github.py:37
05
Agent reads local files from BASE_DIR (d:\TRAE SOLO CN\project\skill-publisher) and uploads them or uses them for further attacks
Impact · upload_to_github.py:66
What drove the risk score up
Credential exposure — hardcoded GitHub PAT +30
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 hardcoded at upload_to_github.py:7; token can be harvested by any agent with filesystem:READ access to the skill directory
SKILL.md metadata vs code mismatch +20
SKILL.md frontmatter declares requires_api_key: false but upload_to_github.py contains a real PAT; SKILL.md only documents CLI-based workflows (clawhub/gh CLI/git push), never mentions the Python script
Undeclared network:WRITE access +10
upload_to_github.py makes direct HTTPS API calls to github.com — this capability is not declared anywhere in SKILL.md
Hardcoded local path exposure +5
BASE_DIR = r'd:\TRAE SOLO CN\project\skill-publisher' at line 9 exposes the author's Windows username and absolute project path; violates SKILL.md Layer 2 local-path scan rules
Most important evidence
Critical Credential Theft
Hardcoded GitHub Personal Access Token
A real GitHub PAT (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) is hardcoded in plaintext at upload_to_github.py:7. Any agent with filesystem:READ access to the skill directory can extract this token and use it to authenticate as the token owner on GitHub, enabling repository creation, file uploads, releases, and code manipulation under the owner's account.
upload_to_github.py:7 Remove the hardcoded token. Use environment variables (os.environ.get('GITHUB_TOKEN')), gh CLI credential cache, or a .env.local file excluded from distribution. Rotate the exposed token immediately via GitHub Settings > Personal Access Tokens.
Critical Doc Mismatch
SKILL.md metadata declares no API key needed; code contains a real PAT
SKILL.md frontmatter has metadata.requires_api_key: false, yet upload_to_github.py embeds a live GitHub PAT. The SKILL.md also only documents CLI-based publishing workflows (clawhub CLI, gh CLI, git push, gh api) — it never mentions the Python script. This creates a false impression of the skill's actual capabilities and security posture.
SKILL.md:3 Update metadata.requires_api_key to true if using REST API methods, or remove the Python script and document only CLI-based workflows. Add an explicit 'Maintenance Tools' section listing upload_to_github.py with its purpose.
High Sensitive Access
Hardcoded Windows absolute path exposing author identity
BASE_DIR = r'd:\TRAE SOLO CN\project\skill-publisher' at upload_to_github.py:9 encodes the author's Windows username ('TRAE SOLO CN') and absolute project path. This violates SKILL.md Layer 2 local-path scan rules and leaks the author's machine identity.
upload_to_github.py:9 Remove BASE_DIR entirely. Derive the skill root directory dynamically (e.g., relative to the script location via __file__) or from an environment variable.
High Doc Mismatch
Undeclared Python script bypasses documented CLI-only workflows
upload_to_github.py implements direct GitHub REST API file uploads using urllib.request and base64 encoding. SKILL.md Phase 3 Step 10 documents a push fallback chain: git push → gh CLI → REST API (as a last resort), but never describes the Python script or its file-reading/uploading behavior. The script is present in the skill root alongside SKILL.md, implying it may be intended for use by agents operating in this skill directory.
upload_to_github.py:1 Either document upload_to_github.py explicitly as a maintainer tool (with a clear disclaimer it is for the skill author only and excluded from distributions), or remove it and rely solely on the documented CLI-based workflows.
Medium Supply Chain
No dependency pinning in publish script
upload_to_github.py uses only standard library modules (urllib.request, json, base64, os, time) — no external dependencies to pin. However, the skill has no requirements.txt or package.json, making it unclear what pip/npm packages the skill itself depends on at runtime.
upload_to_github.py:1 If the skill has runtime Python dependencies, create a requirements.txt with pinned versions. Document any pip/npm package requirements in SKILL.md.
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred READ
upload_to_github.py:66 reads local files via read_local_file() Network Block
Declared NONE
→ Inferred WRITE
upload_to_github.py:15-31 makes authenticated HTTPS requests to api.github.com; SKILL.md only documents CLI tools Environment Pass
Declared NONE
→ Inferred NONE
No env iteration observed Skill Invoke Pass
Declared READ
→ Inferred READ
SKILL.md defines triggers and workflow steps Suspicious artifacts and egress
Critical API Key
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 upload_to_github.py:7
Medium External URL
https://img.shields.io/github/stars/EdwardWason/skill-publisher?style=flat-square README.en.md:5
Medium External URL
https://img.shields.io/badge/license-MIT--0-green?style=flat-square README.en.md:6
Medium External URL
https://img.shields.io/badge/ClawHub-skill--publisher-orange?style=flat-square README.en.md:7
Medium External URL
https://clawhub.ai/skills/skill-publisher README.en.md:7
Medium External URL
https://img.shields.io/badge/Claude%20Code-Skill-blue?style=flat-square README.en.md:8
Medium External URL
https://img.shields.io/github/stars/ references/repo-structure.md:64
Medium External URL
https://img.shields.io/badge/ClawHub- references/repo-structure.md:66
Medium External URL
https://clawhub.ai/skills/ references/repo-structure.md:66
Medium External URL
https://evil.com/collect?data=... references/security-audit.md:50
Medium External URL
https://clawhub.ai/user/edwardwason skill-card.md:7
Medium External URL
https://clawhub.ai/edwardwason/skill-publisher-ai skill-card.md:27
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| urllib.request | stdlib | Python standard library | No | No external dependencies — only stdlib used |
| json | stdlib | Python standard library | No | stdlib |
| base64 | stdlib | Python standard library | No | stdlib |
| os | stdlib | Python standard library | No | stdlib |
| time | stdlib | Python standard library | No | stdlib |
File composition
12 files · 2486 lines
Markdown 10 files · 2301 linesPython 1 files · 180 linesJSON 1 files · 5 lines
Files of concern · 7
SKILL.md SKILL.md metadata declares no API key needed; code contains a real PAT
references/repo-structure.md https://img.shields.io/github/stars/ · https://img.shields.io/badge/ClawHub- · https://clawhub.ai/skills/
references/publish-procedures.md README.en.md https://img.shields.io/github/stars/EdwardWason/skill-publisher?style=flat-square · https://img.shields.io/badge/license-MIT--0-green?style=flat-square · https://img.shields.io/badge/ClawHub-skill--publisher-orange?style=flat-square · https://clawhub.ai/skills/skill-publisher · https://img.shields.io/badge/Claude%20Code-Skill-blue?style=flat-square
upload_to_github.py Hardcoded GitHub Personal Access Token · Hardcoded Windows absolute path exposing author identity · Undeclared Python script bypasses documented CLI-only workflows · No dependency pinning in publish script · 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
references/security-audit.md https://evil.com/collect?data=... · [email protected]
skill-card.md https://clawhub.ai/user/edwardwason · https://clawhub.ai/edwardwason/skill-publisher-ai
Other files · changelog-generation.md · README.md · change-detection.md · CHANGELOG.md · _meta.json
Security positives
Security audit procedures are well-documented in references/security-audit.md with clear PASS/FAIL criteria for credential leaks, local paths, and dangerous commands
Distribution judgment criteria are thorough, correctly identifying maintainer tools (like publish scripts) as should-be-excluded from distributions
SKILL.md explicitly blocks publishing on any security scan FAIL, which is a good defensive design
CLONE: The skill properly documents and recommends gh CLI as the preferred authentication method over token-in-URL or hardcoded tokens
SKILL.md requires user confirmation for repository name, account, visibility, slug, and version before publishing — a good safety gate