Doro Git Secrets Scanner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

This is a legitimate secret-scanning guide, but some examples give third-party tools and CI actions sensitive access without enough pinning or permission limits.

Install only if you are comfortable tightening the examples first: pin tool versions, Docker digests, and GitHub Actions to reviewed commits; add minimal GitHub workflow permissions; avoid exposing GITHUB_TOKEN unless required; do not use cron, hooks, sudo installs, BFG, or git push --force without explicit repository-owner approval and a recovery plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Unpinned External Tool Installations Permit Mutable Supply-Chain Code Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 38-51 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash # Or use Go go install github.com/gitleaks/gitleaks/v8@latest ``` ```bash # Or use Docker docker pull trufflesecurity/trufflehog:latest ``` ### Technical Analysis The installation instructions use the mutable `latest` identifier for both a Go module and a Docker image. Because these identifiers can resolve to different artifacts over time, the code ultimately installed or executed may differ from what was reviewed when the Skill was published. This behavior is related to the Skill's declared secret-scanning functionality, but mutable references are not the minimum-risk mechanism needed to install the scanners. Exact versions and immutable image digests would provide the same functionality while reducing supply-chain exposure. ### Attack Path 1. An attacker compromises an upstream release process, maintainer account, package registry, or container registry. 2. The attacker publishes a malicious artifact under a version selected by `@latest` or replaces the image referenced by the `latest` tag. 3. A user follows the documented installation command. 4. The package installer or container runtime downloads the attacker-controlled artifact. 5. The malicious artifact executes with the permissions available to the invoking user or container environment. ### Impact Assessment A compromised Go tool can execute with the local user's privileges when invoked. A compromised container image can access any files, environment variables, credentials, sockets, or network resources explicitly exposed to the container. Potential consequences include source-code theft, secret exfiltration, repository modification, and further compromise of the developer or CI environment. The precise scope depends on the invoking user's privileges and container configuration.
• Remediation: ## Remediation Suggestions - Replace `@latest` with a reviewed, exact Gitleaks version. - Replace the Docker `latest` tag with a reviewed image digest, such as `image@sha256:...`. - Verify release signatures or checksums before installation where supported. - Document expected publishers and official distribution channels. - Use automated dependency-update tooling to propose version changes for review rather than resolving mutable versions during installation. - Run scanners with only the filesystem and network access required for repository analysis.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:124
• Finding: Mutable GitHub Action Receives Repository Authentication Token## Vulnerability Details **File Location**: `SKILL.md`, lines 124-126 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ```yaml - uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ``` ### Technical Analysis The workflow supplies `GITHUB_TOKEN` to a third-party action referenced through the mutable major-version tag `@v2`. A mutable action tag can be moved to different code after review. If the action's repository, maintainer account, release process, or tag is compromised, replacement code can directly read the token from its environment. The example also does not declare an explicit workflow-level or job-level `permissions` block. Consequently, the effective token permissions depend on GitHub repository, organization, event, and platform defaults rather than a least-privilege policy defined by the workflow. A token may be necessary for some action features, but supplying it to a mutable third-party component without explicit permission restrictions exceeds the minimum safe privilege model. ### Attack Path 1. An attacker compromises the action repository, a maintainer account, or the mechanism controlling the `v2` tag. 2. The attacker moves or replaces the mutable tag with a malicious action revision. 3. A push or pull-request event triggers the documented workflow. 4. The runner downloads and executes the malicious action revision. 5. The action reads `GITHUB_TOKEN` from its environment. 6. The action transmits the token or uses it directly against the GitHub API. 7. The attacker accesses or modifies repository resources permitted by the token before it expires. ### Impact Assessment A compromised action can read checked-out repository contents and access the provided token. Depending on the token permissions and triggering event, it may read private repository data, enumerate metadata, modify repository contents, create comments o ...[truncated 419 chars]
• Remediation: ## Remediation Suggestions - Pin `gitleaks/gitleaks-action` to a reviewed, immutable full commit SHA rather than `@v2`. - Add an explicit minimal permissions policy, for example: ```yaml permissions: contents: read ``` - Remove `GITHUB_TOKEN` from the action environment if the selected scanning mode does not require it. - If a token is required, grant only the specific permissions needed for the action's documented behavior. - Review action source code and release provenance before updating the pinned commit. - Use dependency-update automation to submit reviewed action-SHA upgrades. - Avoid exposing unrelated secrets to the scanning job and isolate it from privileged deployment jobs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`（谨慎使用）
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

• Confidence: 79% confidence
• Finding: This duplicate finding flags the same force-push guidance. In a security-remediation skill, suggesting a destructive git operation without stronger procedural controls can lead to repository integrity loss and accidental data destruction even if the intent is defensive.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`(谨慎使用)
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

• Confidence: 79% confidence
• Finding: This duplicate finding flags the same force-push guidance. In a security-remediation skill, suggesting a destructive git operation without stronger procedural controls can lead to repository integrity loss and accidental data destruction even if the intent is defensive.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The description, headings, and usage instructions are all presented in Chinese, and the file does not indicate that the skill is region-specific or that users may opt into another language. This can violate a language/locale policy where skills should not force a specific language without user choice or clear justification.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
git clone https://github.com/awslabs/git-secrets.git
cd git-secrets
sudo make install
```

## 使用方法

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Ssd 3

Medium

• Confidence: 85% confidence
• Finding: The example output includes a realistic-looking secret value format, which can encourage copying, replay in downstream prompts, or accidental treatment as a live credential. Even if synthetic, publishing secret-like strings in security tooling docs increases the chance of unsafe handling and model memorization or propagation.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 每周扫描
crontab -e
0 0 * * 0 cd /path/to/repo && gitleaks detect --source .
```

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The package description is written entirely in Chinese, which imposes a specific language choice in natural-language metadata without indicating user choice or a region-specific justification. The stated policy flags language or locale constraints when they are forced without opt-in.

Static analysis

No suspicious patterns detected.