ci-gen
4 findings (1 critical, 2 high, 1 medium), mainly data exfiltration, social engineering, unauthorized tool use. Most recent scan 2026-02-05.
This skill presents CRITICAL security risks due to undisclosed external data transmission and credential access. The tool requires OPENAI_API_KEY and sends project data to external servers without transparent disclosure. The description employs social engineering by concealing these dependencies behind 'zero config' marketing claims. The skill executes external code via npx without tool restrictions and collects excessive project data. The combination of credential theft potential, data exfiltration to third-party APIs, and deceptive descriptions creates a high-risk security posture. The skill requires major security improvements including explicit disclosure of external dependencies, data transmission transparency, input validation, and proper allowed-tools restrictions before it can be considered safe for use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this CRITICAL and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Generate GitHub Actions workflows from your project. Use when setting up CI/CD from scratch.
- Package
- 1 file, 2.3 KB
- SKILL.md
- 332 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: CI Generator · Quick Start · What It Does · Usage Examples · Generate workflow for current project · Specify deploy target · Preview without writing · Different targets · Best Practices · When to Use This · Part of the LXGIC Dev Toolkit · Requirements
Findings
CRITICAL Hardcoded External API Dependency with Credential Requirement Data Exfiltrationllm
The skill requires OPENAI_API_KEY environment variable to function, creating a critical data exposure risk. When the agent executes 'npx ai-ci', it will access the user's OpenAI API key from their environment and transmit project data (package.json, config files, project structure) to OpenAI's external servers for analysis. This constitutes unauthorized data exfiltration of both credentials and project intellectual property to a third-party service without explicit user consent about the external transmission.
SKILL.md
Requirements section states: 'Needs OPENAI_API_KEY environment variable' and 'Analyzes your package.json, config files, and project structure' - combining credential access with project data transmission to external AI serviceHIGH Deceptive Description Concealing External Dependencies Social Engineeringllm
The skill description 'Generate GitHub Actions workflows from your project' and marketing claims 'One command. Zero config. Just works' deliberately conceal that this tool requires external API access and transmits project data to OpenAI. The description implies local-only operation when it actually depends on external services and credential access. This social engineering tactic misleads users about the tool's true behavior and data handling practices.
SKILL.md
Description claims 'Zero config' and 'Just works' but Requirements section reveals 'Needs OPENAI_API_KEY environment variable' - concealing mandatory external service dependency and credential requirementHIGH Unauthorized Tool Use via NPX Execution Unauthorized Tool Usellm
The skill instructs the agent to execute 'npx ai-ci' which downloads and runs arbitrary code from npm registry without any allowed-tools restrictions. This creates tool exploitation risk as the agent will execute external code with full system access. The skill has no allowed-tools declaration to restrict Bash execution, and the npx command can execute any code published to npm under the 'ai-ci' package name, creating supply chain attack surface.
SKILL.md
Instructions direct: 'npx ai-ci' with multiple command variations, but YAML manifest shows 'allowed-tools: Not specified' - no restrictions on Bash execution of external codeMEDIUM Command Injection Risk via Unvalidated Parameters Command Injectionllm
The skill demonstrates multiple command-line parameter patterns ('--deploy vercel', '--deploy netlify', '--deploy aws', etc.) that will be passed to the npx command. If the agent constructs these commands using user input without proper validation, it could enable command injection attacks. The skill provides no guidance on input sanitization for the --deploy parameter or other flags.
SKILL.md
Multiple examples show: 'npx ai-ci --deploy [TARGET]' where TARGET comes from user input, with no validation requirements specified in instructionsWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.3 KB |
External hosts referenced
github.com x.com lxgicstudios.com lxgicstudios.substack.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/ai-ci
- Raw scan result: ci-cd-pipeline-generator-scan.json
- Badge for your README:
- Request a re-scan