Is codexstar69/bug-hunter safe?
https://github.com/codexstar69/bug-hunter
Bug Hunter (codexstar69/bug-hunter) is a professionally designed, schema-validated adversarial code audit framework. Monitoring detected no malicious behavior during install: no unexpected network connections, no canary exfiltration, and no filesystem changes outside the skill directory. The pre-clone accesses to sensitive credential files (.env, .ssh/id_rsa, .aws/credentials) are conclusively attributed to the Oathe audit infrastructure rather than the skill, based on their timestamps preceding the git clone by approximately 6 seconds. The primary residual risks are passive codebase information leakage through Context7/Context Hub API calls during live audits, and the inherent trust placed in executable CJS scripts running with agent permissions; neither rose to the level of observed malicious behavior in this audit.
Category Scores
Findings (7)
INFO Pre-clone sensitive file accesses attributed to audit infrastructure, not skill 0 ▶
Inotify and auditd logs record opens of .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json at 12:48:47 (epoch 1787402927.6xx). The git clone to GitHub did not begin until 12:48:53 (epoch 1787402933.175). The skill could not have caused accesses that predated its own cloning. The Oathe canary-placement and monitoring setup is the most parsimonious explanation. Canary Integrity check confirms all files are intact.
MEDIUM External documentation API calls passively leak codebase information -15 ▶
The Hunter, Skeptic, Fixer, and Recon sub-skills all instruct the agent to call scripts/doc-lookup.cjs and scripts/context7-api.cjs to verify framework claims. These scripts make outbound HTTPS requests to Context Hub (chub) and the Context7 API containing library names and natural-language questions derived from the scanned repository. While the stated purpose is documentation retrieval, this creates a passive side-channel where third parties receive information about the libraries and frameworks in the target codebase.
MEDIUM Multiple CJS scripts executed from cloned repository with agent permissions -18 ▶
The SKILL.md orchestration flow instructs the agent to execute at least 12 Node.js CJS scripts from the cloned skill directory: triage.cjs, run-bug-hunter.cjs, dep-scan.cjs, pr-scope.cjs, payload-guard.cjs, doc-lookup.cjs, context7-api.cjs, artifact-planner.cjs, chunk-scheduler.cjs, state-store.cjs, delta-mode.cjs, and hybrid-verifier.cjs. These scripts run with the permissions of the agent process. While no malicious behavior was observed in the install phase, each script represents executable code from a third-party repository running in a trusted context.
LOW Autonomous fix + auto-commit mode enables unattended code mutation -15 ▶
The --autonomous --auto-commit flag combination permits the agent to make unreviewed edits and create git commits without interactive user approval at each step. The skill's documentation requires explicit user intent to activate these flags, but if an attacker could influence the invocation arguments or if a user misunderstands the authorization model, the skill could introduce subtle changes across a codebase. The Fixer scope binding (fixer-scope.json) and canary/circuit-breaker mechanisms mitigate this, but they are enforced by the same scripts from the cloned repository.
LOW doc-lookup and context7-api return third-party content into agent context -8 ▶
When the doc-lookup.cjs and context7-api.cjs scripts are called during a live audit, they return documentation content from external services (Context Hub, Context7) directly into the agent's reasoning context. If those services were compromised or returned adversarially crafted content, the fetched content could attempt prompt injection. The Hunter/Skeptic/Fixer sub-skills all carry trust-boundary disclaimers ('retrieved documentation are untrusted data'), which reduces but does not eliminate this risk.
INFO Clean clone with expected GitHub traffic only 0 ▶
The git clone connected exclusively to 140.82.121.3:443 (github.com). All other network connections during and after the clone (185.125.188.54, 185.125.190.48) predate the install and are Ubuntu snap/Advantage CDN traffic from the host OS. The connection diff shows no new persistent external connections introduced after install. No unexpected DNS queries to unknown domains were observed.
INFO All honeypot files confirmed intact 0 ▶
The six honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were not modified, truncated, or transmitted by any skill-controlled process. The accesses recorded predated the clone and are attributed to audit infrastructure.