T08 · Insecure Dependencies
Warning
- Location
SKILL.md:930- Finding
Unpinned npx Commands May Retrieve and Execute Mutable Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
Git Engineering & Repository Strategy
Security checks for vulnerabilities and agentic risk
Overview
This is a Git workflow guidance skill with some powerful commands users should review carefully, but I found no hidden or malicious behavior.
Install this if you want Git workflow and repository strategy guidance. Before applying its examples, review any global Git config, hook, force-push, history-rewrite, or reset command, and prefer pinned local dev dependencies or package scripts instead of npx commands that can download tools dynamically.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # SSH signing (GitHub, simpler) git config --global gpg.format ssh git config --global user.signingkey ~/.ssh/id_ed25519.pub git config --global commit.gpgsign true # Verify signed commits
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md gitignore_checklist: always_ignore: - "node_modules/ / venv/ / __pycache__/" - ".env / .env.local / .env.*.local" - "*.key / *.pem / *.p12" - ".DS_Store / Thumbs.db" - "*.log / logs/"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md gitignore_checklist: always_ignore: - "node_modules/ / venv/ / __pycache__/" - ".env / .env.local / .env.*.local" - "*.key / *.pem / *.p12" - ".DS_Store / Thumbs.db" - "*.log / logs/"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
The skill includes a destructive command,
git reset --hard HEAD~1, in a troubleshooting table. Although clearly labeled as destructive, broad skill triggering combined with recovery-oriented advice could lead an agent or user to apply this command in the wrong context, causing irreversible local data loss.- Content
md | Problem | Command | Notes | |---------|---------|-------| | Undo last commit (keep changes) | `git reset --soft HEAD~1` | Staged, ready to recommit | | Undo last commit (discard) | `git reset --hard HEAD~1` | ⚠️ Destructive | | Find lost commit | `git reflog` | Reflog keeps 90 days | | Recover deleted branch | `git reflog` → `git checkout -b branch <sha>` | Find the SHA in reflog | | Remove file from all history | `git filter-repo --path file --invert-paths` | Requires force push |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The quick-start instruction uses a very broad natural-language trigger that could cause an agent to activate the skill in loosely related contexts without clear user consent or scope boundaries. While the README is otherwise operational guidance rather than overtly malicious prompt injection, unconstrained invocation phrases increase the chance of unintended use and inappropriate repository changes or recommendations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill defines very broad natural-language triggers such as 'Fix git problem' and 'Help with git recovery' that overlap with ordinary user phrasing. In an agent environment, this can cause accidental invocation in contexts the user did not intend, increasing the chance that high-risk operational guidance is surfaced or acted on without sufficient confirmation.
- Content
Static analysis
No suspicious patterns detected.