Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-03
This skill is a short documentation file that teaches an agent how to use the official GitHub command-line tool (`gh`) to look at issues, pull requests, CI workflow runs, and API endpoints. It contains no scripts, no code that executes on its own, and no network addresses other than a link to the publisher's profile page on the registry. All example commands shown are read-only queries (listing runs, viewing logs, fetching PR fields). The main thing to be aware of is that the skill relies on whatever GitHub permissions the user's existing `gh` login already has, so an agent following it operates with those credentials; the skill itself does not read, copy, or send any credentials anywhere. Nothing in the package attempts to override the agent's other rules or hide its behavior.
| Declared purpose | Help an agent interact with GitHub via the `gh` CLI for issues, pull requests, CI runs, and advanced API queries. |
| Observed behavior | Purely instructional Markdown. It suggests read-only `gh` subcommands (`gh pr checks`, `gh run list`, `gh run view`, `gh api ... --jq`, `gh issue list --json`) and advises using `--repo owner/repo`. No executable files, no file writes, no environment variable access, no downloads, no obfuscation. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill directs the agent to run bash commands using the `gh` CLI, e.g. SKILL.md line 14 `gh pr checks 55 --repo owner/repo`. All documented examples are read-only queries. |
| network | needed | Indirect only: `gh` contacts the GitHub API (SKILL.md line 38 `gh api repos/owner/repo/pulls/55`). The only literal domain in the package is clawhub.ai, a publisher profile link in skill-card.md line 7. |
| credentials | needed | Relies on the user's pre-existing `gh` authentication (skill-card.md line 30 notes it assumes local GitHub CLI authentication). The skill does not read token files or environment variables itself. |
| severity | finding |
|---|---|
| info | Skill operates through the shell using the user's GitHub credentials The skill's entire function is to have the agent run `gh` commands, which act with the permissions of the already-authenticated GitHub CLI session. This is inherent to the declared purpose, but means an agent following it can reach any repository the user's token can reach. SKILL.md:8 Use the `gh` CLI to interact with GitHub. Always specify `--repo owner/repo` when not in a git directory, or use URLs directly. |
| low | Encourages generic `gh api` use, which is not limited to read operations The documented example is a read-only GET, but `gh api` can also perform write methods (POST/PATCH/DELETE) against any GitHub endpoint. The skill does not restrict this; the publisher's own card (line 20) advises reviewing any non-read `gh api` call. SKILL.md:38 gh api repos/owner/repo/pulls/55 --jq '.title, .state, .user.login' |
| info | Publisher discloses the credential-inheritance risk The package explicitly documents that it inherits the user's GitHub CLI scopes and recommends checking `gh auth status` first. This matches the observed behavior; no undisclosed capability was found. skill-card.md:19 Risk: The skill can use the permissions already available through the user's GitHub CLI login. <br> |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | bash, git |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 47 | 51b28818a6f03592… |
_meta.json | 6 | 56fb7f167484f714… |
skill-card.md | 36 | 354c1678ea2226b0… |
For agents
JSON: https://agenteconomy.report/k/github.audit.json · badge: https://agenteconomy.report/k/github.audited.svg ·
skill rating: /k/github · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.