github-cli

clawhub:github-cli

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

92/100

MEDIUM 1

LOW 1

Findings (2)

MEDIUM

Unattended auto-update SUPPLY_011

supply-chain L1346

Detects automatic package or skill updates via cron or scheduled tasks without verification

upgrade --all

FIX

Avoid installing packages from private or unofficial registries specified in skill instructions. Verify the registry URL is legitimate and use scoped packages with registry configuration.

FP?

Likely FP if the private registry is a well-known enterprise registry (e.g., GitHub Packages, Artifactory) documented in the project setup.

LOW

Clipboard access with network EXFIL_006

exfiltration L1725

Detects clipboard access combined with network operations

pbpaste + nc

FIX

Restrict DNS queries to legitimate resolution. Block the construction of DNS names that encode arbitrary data (DNS tunneling). Monitor for unusually long or high-entropy subdomains.

FP?

Likely FP if the match is a documentation reference to DNS lookup functionality for legitimate hostname resolution.