GitHub Bug Report

Access to sensitive environment variables detected

$GITHUB_TOKEN

A GitHub Personal Access Token (PAT) is directly embedded within the skill content, posing a severe risk of unauthorized access to GitHub resources if the skill content is compromised or exposed.

ghp_F51nSHBKkhWhTfRIKVBJIHmloRSJvi24KFXv

The skill executes a local Python script (`scripts/submit_issue.py`), which could lead to arbitrary code execution if the script is compromised or if user-controlled input is unsafely passed as arguments.

python3 scripts/submit_issue.py --title "[v1.x.x] Bug标题" --body "内容"

The skill uses `curl` to make external API calls to GitHub, which could be exploited for data exfiltration or unauthorized actions if the command or its parameters are manipulated.

curl -s "https://api.github.com/search/issues?q=checkpoint+orphan+repo:openclaw/openclaw" -H "Authorization: token $GITHUB_TOKEN"

The skill includes a template for creating cron jobs to schedule future agent actions, which could be abused for persistence or resource exhaustion if not properly controlled.

{"name": "Bug跟进-#<issue号>", "schedule": { "kind": "cron", "expr": "0 10 * * *", "tz": "Asia/Shanghai" }, ...}

A GitHub Personal Access Token (PAT) is hardcoded directly in the skill content. This token can be used to authenticate to the GitHub API and may allow unauthorized access to repositories, issue creation, modification, or deletion, and potentially access to private repositories depending on the token's scope.

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

The skill instructs the agent to create a recurring cron job that autonomously spawns an agent turn to monitor and interact with GitHub issues without user confirmation. This is a pattern of unbounded autonomous action that bypasses human oversight, and the 'isolated' session target further reduces visibility.

"payload": {
  "kind": "agentTurn",
  "message": "检查 GitHub issue #<issue号> 是否有官方回复，如果没有，去 bump 一下（留言：Any update?）"
},
"sessionTarget": "isolated"