gh-issues

Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug]

46/100

Security score

The gh-issues skill was audited on Feb 28, 2026 and we found 26 security issues across 4 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 386

Template literal with variable interpolation in command context

SourceSKILL.md

386

```

medium line 750

Template literal with variable interpolation in command context

SourceSKILL.md

750

```

medium line 210

Curl to non-GitHub URL

SourceSKILL.md

210	curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user

medium line 646

Curl to non-GitHub URL

SourceSKILL.md

646	curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user \| jq -r '.login'

low line 82

Access to hidden dotfiles in home directory

SourceSKILL.md

82	cat ~/.openclaw/openclaw.json \| jq -r '.skills.entries["gh-issues"].apiKey // empty'

medium line 117

Access to hidden dotfiles in home directory

SourceSKILL.md

117	> "GitHub authentication failed. Please check your apiKey in the OpenClaw dashboard or in ~/.openclaw/openclaw.json under skills.entries.gh-issues."

medium line 215

Access to hidden dotfiles in home directory

SourceSKILL.md

215	> "GitHub authentication failed. Please check your apiKey in the OpenClaw dashboard or in ~/.openclaw/openclaw.json under skills.entries.gh-issues."

low line 349

Access to hidden dotfiles in home directory

SourceSKILL.md

349	GH_TOKEN=$(cat ~/.openclaw/openclaw.json 2>/dev/null \| jq -r '.skills.entries["gh-issues"].apiKey // empty') \|\| GH_TOKEN=$(cat /data/.clawdbot/openclaw.json 2>/dev/null \| jq -r '.skills.entries["gh-is

medium line 384

Access to hidden dotfiles in home directory

SourceSKILL.md

384	export GH_TOKEN=$(cat ~/.openclaw/openclaw.json 2>/dev/null \| node -e "const fs=require('fs');const d=JSON.parse(fs.readFileSync(0,'utf8'));console.log(d.skills?.entries?.['gh-issues']?.apiKey\|\|'')")

low line 717

Access to hidden dotfiles in home directory

SourceSKILL.md

717	GH_TOKEN=$(cat ~/.openclaw/openclaw.json 2>/dev/null \| jq -r '.skills.entries["gh-issues"].apiKey // empty') \|\| GH_TOKEN=$(cat /data/.clawdbot/openclaw.json 2>/dev/null \| jq -r '.skills.entries["gh-is

low line 101

External URL reference

SourceSKILL.md

101	"https://api.github.com/repos/{SOURCE_REPO}/issues?per_page={limit}&state={state}&{query_params}"

low line 192

External URL reference

SourceSKILL.md

192	git remote add fork https://x-access-token:[email protected]/{PUSH_REPO}.git

low line 210

External URL reference

SourceSKILL.md

210	curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user

low line 222

External URL reference

SourceSKILL.md

222	"https://api.github.com/repos/{SOURCE_REPO}/pulls?head={PUSH_REPO_OWNER}:fix/issue-{N}&state=open&per_page=1"

low line 238

External URL reference

SourceSKILL.md

238	"https://api.github.com/repos/{PUSH_REPO}/branches/fix/issue-{N}"

low line 430

External URL reference

SourceSKILL.md

430	git remote set-url {PUSH_REMOTE} https://x-access-token:[email protected]/{PUSH_REPO}.git

low line 449

External URL reference

SourceSKILL.md

449	https://api.github.com/repos/{SOURCE_REPO}/pulls \

low line 594

External URL reference

SourceSKILL.md

594	"https://api.github.com/repos/{SOURCE_REPO}/pulls?state=open&per_page=100"

low line 611

External URL reference

SourceSKILL.md

611	"https://api.github.com/repos/{SOURCE_REPO}/pulls/{pr_number}/reviews"

low line 618

External URL reference

SourceSKILL.md

618	"https://api.github.com/repos/{SOURCE_REPO}/pulls/{pr_number}/comments"

low line 625

External URL reference

SourceSKILL.md

625	"https://api.github.com/repos/{SOURCE_REPO}/issues/{pr_number}/comments"

low line 636

External URL reference

SourceSKILL.md

636	"https://api.github.com/repos/{SOURCE_REPO}/pulls/{pr_number}"

low line 646

External URL reference

SourceSKILL.md

646	curl -s -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/user \| jq -r '.login'

low line 778

External URL reference

SourceSKILL.md

778	git remote set-url {PUSH_REMOTE} https://x-access-token:[email protected]/{PUSH_REPO}.git

low line 787

External URL reference

SourceSKILL.md

787	https://api.github.com/repos/{SOURCE_REPO}/pulls/{pr_number}/comments/{comment_id}/replies \

low line 794

External URL reference

SourceSKILL.md

794	https://api.github.com/repos/{SOURCE_REPO}/issues/{pr_number}/comments \

Scanned on Feb 28, 2026

View Security Dashboard