github-action-gen

SAFE max severity MEDIUMSkillSpector Caution 42 registry clawhub.ai last scanned 2026-02-06 1 scan

Verdict safe, but 3 findings (2 medium, 1 low), mainly social engineering, data exfiltration. Most recent scan 2026-02-06.

This skill has MEDIUM severity security concerns primarily related to deceptive presentation and undisclosed external dependencies. The skill masquerades as an agent capability for generating GitHub Actions workflows, but actually instructs users to run an external NPX package that requires OpenAI API credentials and makes network calls. There are no actual Python/Bash scripts that would allow the agent to generate workflows locally. The skill also contains promotional content and has incomplete manifest metadata. While not containing direct malicious code (since there are no scripts), the deceptive nature and undisclosed credential requirements create security risks. Users expecting local workflow generation will instead be directed to run external tools that access their API keys and transmit data to third-party services without clear disclosure.
Scanner's overall assessment (LLM analyzer)

Findings3

Critical0

High0

Medium2

Low1

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 42

Score42 / 100

Issues16

CategoriesMCP Rug Pull Supply Chain MCP Least Privilege

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Generate GitHub Actions workflows from plain English. Use when setting up CI.

Package: 7 files, 36 KB
SKILL.md: 298 words, 12+ sections
Code: TypeScript (2)

SKILL.md covers: GitHub Action Generator · Quick Start · What It Does · Usage Examples · Test and deploy · PR checks · Docker workflow · Scheduled job · Best Practices · When to Use This · Part of the LXGIC Dev Toolkit · Requirements

Findings

MEDIUM Deceptive Skill Description - External Tool Masquerading as Agent Skill Social Engineeringllm

The skill presents itself as an agent skill for generating GitHub Actions workflows, but the instructions exclusively describe using an external NPX package ('npx ai-github-action'). This is misleading because agent skills should contain executable logic (Python/Bash scripts) that the agent runs directly. Instead, this skill appears to be promotional content for an external tool, not a functional agent skill. Users expecting the agent to generate workflows will instead be instructed to run external commands that require OPENAI_API_KEY and make network calls to OpenAI's API.

SKILL.md

Quick Start section shows: 'npx ai-github-action "test and deploy on push to main"' - This is an external NPX package call, not agent-executable code. The skill contains no Python/Bash scripts that would allow the agent to actually generate workflows.

Remediation: Either: (1) Include actual Python/Bash scripts that generate GitHub Actions YAML locally using the agent's capabilities, or (2) Clearly disclose in the description that this skill instructs users to run an external NPX tool rather than having the agent generate workflows directly. The current description 'Generate GitHub Actions workflows from plain English' implies the agent will do this, which is misleading.

MEDIUM Undisclosed External API Dependency and Credential Requirement Data Exfiltrationllm

The skill requires users to set OPENAI_API_KEY environment variable to use the external NPX tool, but this critical requirement is buried in the documentation and not disclosed in the manifest description. This creates a data exposure risk because: (1) Users may unknowingly expose their OpenAI API keys when running the external tool, (2) The external tool will send user input (workflow descriptions) to OpenAI's API, and (3) There's no transparency about what data is transmitted or how API keys are used by the external package.

SKILL.md:52

'Needs OPENAI_API_KEY environment variable' - This requirement is mentioned only in the Requirements section, not in the manifest description. Users running 'npx ai-github-action' will be executing code that accesses their OpenAI credentials and makes network calls.

Remediation: (1) Disclose the OpenAI API requirement prominently in the skill description/manifest, (2) Warn users that their API keys and input will be sent to external services, (3) Consider implementing local workflow generation instead of relying on external API calls, (4) If keeping external dependency, add explicit user consent before credential access.

LOW Promotional Content Disguised as Functional Skill Social Engineeringllm

The skill contains significant promotional content for 'LXGIC Studios' and their '110+ free developer tools', including links to GitHub, Twitter, Substack, and website. While not directly harmful, this transforms the skill from a focused utility into marketing material. The 'Part of the LXGIC Dev Toolkit' section and repeated branding ('LXGIC Studios') suggests the primary purpose may be promotional rather than providing genuine agent functionality. This is misleading when users expect skills to extend agent capabilities, not serve as advertisements.

SKILL.md

'This is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work. Find more: GitHub: https://github.com/LXGIC-Studios, Twitter: https://x.com/lxgicstudios, Substack: https://lxgicstudios.substack.com, Website: https://lxgicstudios.com'

Remediation: (1) Remove or significantly reduce promotional content, (2) Focus skill documentation on functionality and usage, (3) If attribution is needed, limit it to a single line (e.g., 'Created by LXGIC Studios'), (4) Move marketing content to a separate README or website rather than embedding it in the skill instructions.

What is in the package

File	Kind	Size
`README.md`	doc	569 B
`SKILL.md`	doc	2.0 KB
`package-lock.json`	config	30 KB
`package.json`	config	618 B
`tsconfig.json`	config	251 B
`src/cli.ts`	script	1.3 KB
`src/index.ts`	script	767 B

External hosts referenced

registry.npmjs.org github.com feross.org www.patreon.com lxgicstudios.com lxgicstudios.substack.com paypal.me x.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

OPENAI_API_KEY

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/github-action-gen
Raw scan result: github-action-generator-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-github-action-gen.svg)
Request a re-scan