Skill

create-github-issue

skill:nvidia/openshell#create-github-issue

Create GitHub issues using the gh CLI. Use when the user wants to create a new issue, report a bug, request a feature, or create a task in GitHub. Trigger keywords - create issue, new issue, file bug, report bug, feature request, github issue.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:42 UTC at fa2d381

findings

medium

highest severity

threat classes

2,140

files scanned

25/25

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/create-github-issue:.agents/skills/create-github-issue/SKILL.md:136:HIJACK
suspicious: finding skill:.agents/skills/create-github-issue:.agents/skills/create-github-issue/SKILL.md:164:HIJACK

Security findings 2

Agent hijacking

mediumContextual riskmedium confidence

The skill directs the agent to adopt and follow process directives (Label Discovery, state:* label definitions, triage → validation → human acceptance, Branch Names) defined in a repository-root CONTRIBUTING.md that no agent/MCP client consumes, so at runtime the agent ingests behavioral instructions from content outside everything reviewed.

.agents/skills/create-github-issue/SKILL.md:136-139

Follow Label Discovery in `CONTRIBUTING.md` to retrieve every page of current `state:*` label definitions and resolve unclear meanings, then follow its triage → validation → human acceptance process.

vector:instruction

Counter-argument considered

The strongest counter-case (consulting a repo's CONTRIBUTING.md is standard practice and the paraphrased directives are restrictive) fails because no carve-out or in-artifact mitigation covers making an unshipped file the agent's behavioral authority, and the runtime rule keeps the chain alive regardless of that file's current contents; the directive, its undeclared status relative to the declared gh-CLI capability, and the concrete instruction are all directly evidenced.

Agent hijacking

mediumContextual riskmedium confidence

After creating an issue, the skill directs the agent to follow Branch Names in CONTRIBUTING.md when creating a branch, adopting behavioral instructions from a file the skill does not ship.

.agents/skills/create-github-issue/SKILL.md:164

Create a branch following Branch Names in `CONTRIBUTING.md`.

vector:instruction

Counter-argument considered

The directive is openly stated, but open disclosure is not a carve-out and no mitigation in the shown units neutralizes making an unshipped CONTRIBUTING.md the authority for the agent's branch-creation behavior at runtime; reach, harm, undeclared status, and the concrete instruction all hold on the cited unit.

Open questions 6

What the analysis could not settle from the code alone.

Is the frontmatter status claim metadata 'internal: true' consumed by any skill-loading or permission gate that changes scrutiny or execution permissions for this skill?

The declared description is generic ('Use when the user wants to create a new issue... in GitHub') but the body is scoped to the OpenShell project (first-hand OpenShell-use attestation required, OpenShell-only framing, CONTRIBUTING.md triage process); confirm this skill is only deployed inside the OpenShell repository, since elsewhere it could cause the agent to produce issue content mis-framed as OpenShell feedback.

Manipulation

[file request CONTRIBUTING.md] Do the Label Discovery section, the state:* label definitions, the triage → validation → human acceptance process, and the Branch Names section contain any agent-directed commands, data access, network sends, credential access, or behavioral directives beyond issue labeling and branch naming?

Agent hijacking

[file request CONTRIBUTING.md] Do the Label Discovery section, the state:* label definitions, the triage/validation/human-acceptance process, and the Branch Names section of CONTRIBUTING.md contain instructions that steer the agent beyond creating GitHub issues (extra commands, data access, network sends, or behavioral directives)?

Agent hijacking

[file request CONTRIBUTING.md] The skill instructs the agent to 'Follow Label Discovery in CONTRIBUTING.md to retrieve every page of current state:* label definitions' and follow 'its triage → validation → human acceptance process' plus 'Branch Names in CONTRIBUTING.md'. Does that unshipped referenced content stay within issue labeling, triage, and branch naming, or does it contain instructions that override user intent, send data off-host, or touch credentials?

Agent hijacking

[file request CONTRIBUTING.md] What do the 'Label Discovery' and 'Branch Names' sections instruct the agent to run (e.g., paginated gh label list, git branch/checkout), and do any of those steps go beyond reading repository labels or local git operations?

Code execution

Coverage gaps 42

Parts of the artifact the static analysis could not fully examine.

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-binaries.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-images.yml