automate-github-issues

Fail

Audited by Runlayer on Feb 21, 2026

Risk Level: HIGH
Scan Summary
Max Score
96%
Files
20
Flagged
18
Chunks
22
Flagged Files (18)
scripts/fleet-merge.tsHIGH
96.5%

Malicious tool definition detected

2); const PR_POLL_INTERVAL_MS = 30_000; const PR_POLL_TIMEOUT_MS = 15 * 60 * 1000; if (!GITHUB_TOKEN) { console.error("❌ GITHUB_TOKEN environment variable is required."); process.exit(1); } const headers = { Authorization: `Bearer ${GITHUB_TOKEN}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28", } as const; const API = `https://api.github.com/repos/${OWNER}/${REPO}`; const date = new Intl.DateTimeFormat("en-CA", { year: "numeric", month: "2-digit", day: "2-digit" })

Tool: scripts/fleet-merge.ts [2/2] Description: passed.

assets/.env.exampleHIGH
94.8%

Malicious tool definition detected

Tool: assets/.env.example Description: # Environment variables for automate-github-issues skill # Copy this to .env and fill in your values # Your Jules API key (required for dispatching sessions)

scripts/setup.shHIGH
87.5%

Malicious tool definition detected

Tool: scripts/setup.sh Description: #!/bin/bash # Copyright 2026 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License.

scripts/prompts/analyze-issues.tsHIGH
83.8%

Malicious tool definition detected

// See the License for the specific language governing permissions and // limitations under the License. import type { AnalyzeIssuesPromptOptions } from "../types.js"; export function analyzeIssuesPrompt({ issuesMarkdown, repoFullName, }: AnalyzeIssuesPromptOptions): string { const now = new Date(); const YYYY_MM_DD = `${now.getFullYear()}_${String(now.getMonth() + 1).padStart(2, "0")}_${String(now.getDate()).padStart(2, "0")}`; return `Analyze ${repoFullName} open issues and produce implementat

SKILL.mdHIGH
81.0%

Malicious tool definition detected

Tool: SKILL.md Description: --- name: automate-github-issues description: Set up automated GitHub issue triage and resolution using parallel Jules coding agents allowed-tools: - "Bash" - "Read" - "Write" --- # Automate GitHub Issues with Jules You are setting up a repository to automatically analyze open GitHub issues, plan implementation tasks, and dispatch parallel Jules coding agents to fix them.

assets/fleet-dispatch.ymlHIGH
78.3%

Malicious tool definition detected

Tool: assets/fleet-dispatch.yml Description: # Copyright 2026 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License.

assets/fleet-merge.ymlHIGH
78.3%

Malicious tool definition detected

Tool: assets/fleet-merge.yml Description: # Copyright 2026 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License.

package.jsonHIGH
78.3%

Malicious tool definition detected

Tool: package.json Description: { "name": "automate-github-issues", "private": true, "type": "module", "scripts": { "setup": "bash scripts/setup.sh", "analyze": "bun run fleet-analyze.ts", "plan": "bun run fleet-plan.ts", "dispatch": "bun run fleet-dispatch.ts", "merge": "bun run fleet-merge.ts" },

scripts/fleet-analyze.tsHIGH
78.3%

Malicious tool definition detected

// You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

scripts/fleet-dispatch.tsHIGH
78.3%

Malicious tool definition detected

import path from "node:path"; import { findUpSync } from "find-up"; import type { IssueAnalysis } from "./types.js"; import { jules } from "@google/jules-sdk"; import { getGitRepoInfo, getCurrentBranch } from "./github/git.js"; const date = new Intl.DateTimeFormat("en-CA", { year: "numeric", month: "2-digit", day: "2-digit" }) .format(new Date()) .replaceAll("-", "_"); const root = path.dirname(findUpSync(".git")!); const fleetDir = path.join(root, ".fleet", date); const tasksPath = path.join(fl

scripts/fleet-plan.tsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/fleet-plan.ts Description: // Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License.

scripts/github/cache-plugin.tsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/github/cache-plugin.ts Description: // Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License.

scripts/github/issues.tsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/github/issues.ts Description: // Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License.

scripts/github/markdown.tsHIGH
78.3%

Malicious tool definition detected

[]).map((a) => a.login); const reactions = issue.reactions; const lines = [ `## #${issue.number}: ${issue.title}`, ``, `🔗 ${issue.html_url}`, ``, `| Field | Value |`, `|-------|-------|`, `| **Author** | ${issue.user?.login ??

scripts/prompts/bootstrap.tsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/prompts/bootstrap.ts Description: // Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License.

scripts/types.tsHIGH
78.3%

Malicious tool definition detected

Tool: scripts/types.ts Description: // Copyright 2026 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License.

resources/architecture.mdMEDIUM
66.2%

Tool passed security scan

README.mdMEDIUM
63.1%

Tool passed security scan

Passed Files (2)Click to expand
tsconfig.jsonOK
27.3%

Tool passed security scan

scripts/github/git.tsOK
24.1%

Tool passed security scan

Audit Metadata
Max File Score
96%
Classification
UNKNOWN_SERVER
Files Scanned
20
Files Flagged
18
Chunks Analyzed
22
Analyzed
Feb 21, 2026, 01:18 PM
Security Audit — runlayer — automate-github-issues