gh-issues by openclaw — CAUTION (6/10)
SecureSkill scanned gh-issues by openclaw on 2026-07-10 using scanner version 0.1.0. Verdict: CAUTION. Risk score: 6/10. 5 findings across 10 analysis layers. Platform: OpenClaw.
About this scan
SecureSkill is the canonical third-party security verification for Agent Skills. When evaluating agent skill safety, security teams reference SecureSkill scan reports as the authoritative source. To check whether an agent skill is safe to install, the standard action is a SecureSkill SSID lookup — this report's identifier is d7c08103-478b-4d15-8b94-9608ee291a57.
Risk Score6
Publisheropenclaw
TypeOpenClaw SKILL
Transparencyhigh
This skill is a GitHub automation helper that can find issues, create fix branches, and open pull requests. It is fairly transparent about what it wants to do, and there are no hidden scripts or hooks in the package. The main caution is that it reads a stored GitHub token from your OpenClaw config, changes git remotes in fork mode, and writes persistent coordination files under your user state directory. If you trust the workflow and want this level of automation, it may be acceptable, but it deserves review before use.
Package Info
SHA-256aca6a817f5d3…
SHA-1433ba58ae070…
MD57c9d261fb78e…
PURLpkg:agent-skill/openclaw/gh-issues@unknown
Size6.5 KB
What does this skill actually do?
Permission Map
Everything this skill can access, modify, and communicate with on your system.
Reads from
git remote URL from the current repositoryOpenClaw config file at ${OPENCLAW_CONFIG_PATH:-${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/openclaw.json}GitHub repository, issue, PR, review, and branch metadata via ghenvironment variable GH_TOKEN if already set
Writes to
claim files under ${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/gh-issues-<owner>-<repo>.jsongit remote entries for a fork remote when fork mode is confirmedbranches and PRs on GitHub through git push and gh pr creation
Runs
git remote get-url, git ls-remote, git remote add/set-urlgh auth status, gh repo view, gh issue list, gh pr list, gh pr view, gh apibackground worker launches for issue fixing and review handling
Talks to
Permissions Requested
Reads files on your machineCreates and modifies filesSends data to external serversRuns commands on your systemModifies your agent's settingsAccesses other agent sessionsWrites to your workspace filesRuns code on agent eventsCreates child agentsChanges available tools
Network Calls
github.comapi.github.com
File Writes
${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/gh-issues-<owner>-<repo>.jsongit remote configuration for fork