ClawHub
Back to skill

Security audit

Git Commit Helper Pro

Security checks for vulnerabilities and agentic risk

Overview

This Git helper is mostly aligned with its purpose, but its commit workflow can stage every repository change and create a commit without clearly requiring user confirmation.

Review the repository status before using the commit function. Only install this if you are comfortable with an assistant that may stage all tracked, untracked, and deleted files when asked to commit; avoid using it in repositories that may contain secrets or unrelated work unless you manually control what is staged first.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The activation keywords are extremely broad ('git', '提交', 'commit', '分支'), making accidental invocation during ordinary development discussions likely. In a skill that can inspect repository state and perform mutating Git actions, unintended activation increases the chance of surprise execution and unsafe actions.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill description and usage sections emphasize convenience but do not clearly disclose that the commit workflow stages all changes via 'git add -A' and then creates a commit automatically. This can cause users to unintentionally commit sensitive files, unrelated work, secrets, or deletions across the repository, especially if they invoke the helper expecting read-only assistance.

Static analysis

No suspicious patterns detected.