Connects AI agents to GitHub repositories for code reading, file creation, PR management, and issue tracking. Widely used but requires careful scope restriction.
Security Rating
72 / 100
Vendor Type
Official (GitHub / Anthropic)
Risk Category
High Risk
Exposed Tools & Function Calls
- create_or_update_file
- search_repositories
- create_issue
- create_pull_request
- fork_repository
- push_files
- create_branch
- get_file_contents
Required Permission Scopes
- repo:write
- repo:read
- issues:write
- pull_requests:write
- admin:org (if enabled)
Vulnerability & Risk Analysis
Over-permissioned PAT scope (High)
Using classic PATs with "repo" scope grants write access to ALL repositories, including private ones. This massively exceeds typical agent needs.
Fix: Use fine-grained PATs scoped to specific repositories with only read access unless write is explicitly required.
Code injection via file creation (High)
The create_or_update_file tool allows an agent to write arbitrary code to any accessible repository. A compromised agent or prompt injection could introduce malicious code.
Fix: Apply branch protection rules. Require human review of all PRs. Never allow direct commits to main/master branch.
Secret exfiltration via search (Medium)
search_repositories and get_file_contents can be used to search for and exfiltrate hardcoded secrets in private repositories.
Fix: Enable GitHub Secret Scanning. Limit search scope to public repos unless private access is strictly required.
Fork-and-PR attack vector (Medium)
An agent with fork_repository access can fork a target repo, push malicious code, and create a PR to merge it into the original repository.
Fix: Disable fork_repository permission unless explicitly needed. Enable required reviewers for all PRs.