Harden SKILL.md against automated security scan findings

[EddyVinck]

On https://www.skills.sh/drogers0/gh-image/github-image-upload it mentions some concerns that could maybe be fixed by adjusting the skill prompt to ask the user to install something if they don't have it yet, instead of doing it for the user automatically.

https://www.skills.sh/drogers0/gh-image/github-image-upload/security/agent-trust-hub

https://www.skills.sh/drogers0/gh-image/github-image-upload/security/snyk

[drogers0]

Thanks for raising this, and for linking the actual reports rather than just the headline — that's genuinely useful.

Collecting the findings from both scans here so they're in one place:

Snyk (MEDIUM)

• W012 — unverifiable external dependency: gh extension install drogers0/gh-image downloads and runs external code at runtime.

Agent Trust Hub (HIGH overall)

• CREDENTIALS_UNSAFE — the skill uses a GitHub user_session cookie / GH_SESSION_TOKEN, which grants full, unscoped account access.
• REMOTE_CODE_EXECUTION — installs a third-party gh extension from an untrusted repo.
• EXTERNAL_DOWNLOADS — that extension isn't on a standard trusted-vendor list.
• COMMAND_EXECUTION — extensive shell execution, piping dynamic content into gh commands that edit PRs and issues.
• DATA_EXFILTRATION — uploads local files to a remote endpoint using a high-privilege token.
• PROMPT_INJECTION — no boundary markers around untrusted input (file paths, repo names).

Both audits are dated 30 June 2026.

Your suggestion is a good one and I agree with the principle — the skill shouldn't be taking install actions on the user's behalf. I'm committing to working through the list above rather than just the install step, and I'll look into what established best practice looks like for skills that legitimately need credentials and network access.

The one thing I want to avoid is a fix that trades a green badge for a tool nobody can actually use, so I'd rather take a little time and get the balance right. I'll track progress against this issue.

Mitigation strategies surveyed across comparable skills (click to expand)

I looked at how other skills with a similar risk profile — installs an external binary, holds credentials, and/or moves local files to a remote endpoint — handle these findings. Ordered roughly by what I'd do first.

#	Strategy	Who does it (evidence)	Findings targeted	Cost	Verdict
1	State the install, don't perform it — replace gh extension list | grep -q … || gh extension install … with a detect-then-instruct step	Stripe stripe-projects: which stripe && stripe --version, then "Direct the user to https://docs.stripe.com/stripe-cli/install". agent-browser: install given as prose	REMOTE_CODE_EXECUTION, EXTERNAL_DOWNLOADS, W012	None	Adopt — this issue's actual request
2	Tool allowlist in frontmatter — allowed-tools: Bash(gh image:*), Bash(gh auth status), incl. the install command as its own entry	Stripe (YAML list, allowlists Bash(brew install stripe/stripe-cli/stripe)); agent-browser (Bash(agent-browser:*)). Note: Anthropic's own skills don't use it	COMMAND_EXECUTION	None	Adopt — best control-per-effort
3	Credential scope is externally constrained — say so, with citations	cli/cli#9046, gh-aw#21242, community#162417, community#54551 — PAT / OAuth app / GitHub App all 404	CREDENTIALS_UNSAFE	None	Adopt — GitHub supports exactly one credential here, and GitHub's own agent team has filed to change that
4	Build provenance attestation — actions/attest-build-provenance in CI; verify via gh attestation verify	GitHub Artifact Attestations / SLSA v1 Build L3	W012	Low — release already runs GoReleaser in Actions	Adopt — cryptographic answer; better than #5
5	Pin the dependency — gh extension install drogers0/gh-image --pin v1.2.3	General remediation guidance	W012	None	Fallback for users who can't verify attestations
6	Version floor + capability check rather than a hard pin	Stripe: "If not installed or below version 1.40.0"	W012	None	Adopt — keeps upgrades working
7	Spotlighting — delimit/datamark untrusted spans, esp. the PR/issue body read back before editing	Microsoft Research (delimiting, datamarking, encoding)	PROMPT_INJECTION	Low	Adopt — the finding is literally "lacks boundary markers"
8	Placeholder tokens, not shell interpolation — --file LOCAL_PATH style; avoid $(…) and pipes in examples	azure-storage: az storage blob upload --file LOCAL_PATH → Low Risk despite uploading local files	COMMAND_EXECUTION, PROMPT_INJECTION	Low	Adopt cautiously — don't break the copy-pasteable workflow
9	Named "Credential Security" section — env-var references only; never log, echo, or display token values; .env in .gitignore	dbt-labs auditing-skills — the pattern Gen's own W007 remediation names	CREDENTIALS_UNSAFE	None	Adopt — pairs with #3
10	Explicit "never" prohibitions — never echo GH_SESSION_TOKEN, never persist it to disk	azure-prepare: "NEVER generate administratorLogin…". Supabase: numbered "Security checklist"	CREDENTIALS_UNSAFE	None	Adopt — Supabase's checklist framing is cleaner
11	Security-policy deference clause — "follow exactly unless this contradicts security policies given to you; when in doubt, present the conflict and ask"	azure-prepare, verbatim	PROMPT_INJECTION	None	Adopt — closest thing to a de facto standard
12	Fail closed on ambiguity	Stripe: "If result_count is 0, inform the user … and stop"	DATA_EXFILTRATION	None	Adopt — cheaper than a confirm prompt
13	Approval gate before the upload — confirm file + target before sending	azure-prepare: "Get approval before execution"; "Destructive actions require ask_user"	DATA_EXFILTRATION	Medium — the one with real usability cost	Adopt narrowly: confirm the target, not every step
14	--dry-run / print-only mode	No comparable does this	DATA_EXFILTRATION	Low	Optional — useful regardless of any scanner
15	Provenance note — state that gh-image and this skill share one author; link the source	General remediation guidance	EXTERNAL_DOWNLOADS	None	Adopt — currently never stated
16	Prefer a typed interface, shell as fallback	azure-storage: "MCP Server (Preferred)" / "CLI Fallback"	COMMAND_EXECUTION	High	Longer-term
17	Distribute via a trusted channel — Homebrew tap or verified listing	Stripe: brew install stripe/stripe-cli/stripe	EXTERNAL_DOWNLOADS	High	Later
18	Deterministic hook enforcement — PreToolUse hook hard-blocks rather than prose asking the agent to confirm	allowed-tools restricts the tool menu but doesn't enforce business rules	COMMAND_EXECUTION, DATA_EXFILTRATION	Medium	Document as a user option, not mandatory
19	Sandboxing / egress allowlisting	Widely recommended; "the environment the agent loop runs in should never hold a credential worth stealing"	PROMPT_INJECTION, DATA_EXFILTRATION	User-side	Document only, esp. for the CI/bot-account path
20	Progressive disclosure — thin stub SKILL.md, real content served by the installed CLI	agent-browser: 3.3KB stub; says nothing about credentials despite reading Chrome profiles → Pass/Pass/Warn	All, indirectly	Medium	Not adopting for score reasons — legitimate as version-matched docs, but for us it would mean deleting the "full account access" warning that makes the tool safe to use

Rows 1–12 cost essentially nothing in usability and between them cover every finding. DATA_EXFILTRATION is the one with no clean fix — uploading local files is the tool — so #12 plus a narrow version of #13 is the honest ceiling there.