Doro Git Secrets Scanner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

This is a legitimate secret-scanning guide, but some examples give third-party tools and CI actions sensitive access without enough pinning or permission limits.

Install only if you are comfortable tightening the examples first: pin tool versions, Docker digests, and GitHub Actions to reviewed commits; add minimal GitHub workflow permissions; avoid exposing GITHUB_TOKEN unless required; do not use cron, hooks, sudo installs, BFG, or git push --force without explicit repository-owner approval and a recovery plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned External Tool Installations Permit Mutable Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-51
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

# Or use Go
go install github.com/gitleaks/gitleaks/v8@latest

bash

# Or use Docker
docker pull trufflesecurity/trufflehog:latest

Technical Analysis

The installation instructions use the mutable latest identifier for both a Go module and a Docker image. Because these identifiers can resolve to different artifacts over time, the code ultimately installed or executed may differ from what was reviewed when the Skill was published.

This behavior is related to the Skill's declared secret-scanning functionality, but mutable references are not the minimum-risk mechanism needed to install the scanners. Exact versions and immutable image digests would provide the same functionality while reducing supply-chain exposure.

Attack Path

1. An attacker compromises an upstream release process, maintainer account, package registry, or container registry.
2. The attacker publishes a malicious artifact under a version selected by @latest or replaces the image referenced by the latest tag.
3. A user follows the documented installation command.
4. The package installer or container runtime downloads the attacker-controlled artifact.
5. The malicious artifact executes with the permissions available to the invoking user or container environment.

Impact Assessment

A compromised Go tool can execute with the local user's privileges when invoked. A compromised container image can access any files, environment variables, credentials, sockets, or network resources explicitly exposed to the container. Potential consequences include source-code theft, secret exfiltration, repository modification, and further compromise of the developer or CI environment. The precise scope depends on the invoking user's privileges and container configuration.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact Gitleaks version.
• Replace the Docker latest tag with a reviewed image digest, such as image@sha256:....
• Verify release signatures or checksums before installation where supported.
• Document expected publishers and official distribution channels.
• Use automated dependency-update tooling to propose version changes for review rather than resolving mutable versions during installation.
• Run scanners with only the filesystem and network access required for repository analysis.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:124

Finding

Mutable GitHub Action Receives Repository Authentication Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 124-126
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

yaml

      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Technical Analysis

The workflow supplies GITHUB_TOKEN to a third-party action referenced through the mutable major-version tag @v2. A mutable action tag can be moved to different code after review. If the action's repository, maintainer account, release process, or tag is compromised, replacement code can directly read the token from its environment.

The example also does not declare an explicit workflow-level or job-level permissions block. Consequently, the effective token permissions depend on GitHub repository, organization, event, and platform defaults rather than a least-privilege policy defined by the workflow.

A token may be necessary for some action features, but supplying it to a mutable third-party component without explicit permission restrictions exceeds the minimum safe privilege model.

Attack Path

1. An attacker compromises the action repository, a maintainer account, or the mechanism controlling the v2 tag.
2. The attacker moves or replaces the mutable tag with a malicious action revision.
3. A push or pull-request event triggers the documented workflow.
4. The runner downloads and executes the malicious action revision.
5. The action reads GITHUB_TOKEN from its environment.
6. The action transmits the token or uses it directly against the GitHub API.
7. The attacker accesses or modifies repository resources permitted by the token before it expires.

Impact Assessment

A compromised action can read checked-out repository contents and access the provided token. Depending on the token permissions and triggering event, it may read private repository data, enumerate metadata, modify repository contents, create comments o ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gitleaks/gitleaks-action to a reviewed, immutable full commit SHA rather than @v2.
• Add an explicit minimal permissions policy, for example:

yaml

permissions:
  contents: read

• Remove GITHUB_TOKEN from the action environment if the selected scanning mode does not require it.
• If a token is required, grant only the specific permissions needed for the action's documented behavior.
• Review action source code and release provenance before updating the pinned commit.
• Use dependency-update automation to submit reviewed action-SHA upgrades.
• Avoid exposing unrelated secrets to the scanning job and isolate it from privileged deployment jobs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 79% confidence

Finding

This duplicate finding flags the same force-push guidance. In a security-remediation skill, suggesting a destructive git operation without stronger procedural controls can lead to repository integrity loss and accidental data destruction even if the intent is defensive.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`（谨慎使用）
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 79% confidence

Finding

This duplicate finding flags the same force-push guidance. In a security-remediation skill, suggesting a destructive git operation without stronger procedural controls can lead to repository integrity loss and accidental data destruction even if the intent is defensive.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`(谨慎使用)
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description, headings, and usage instructions are all presented in Chinese, and the file does not indicate that the skill is region-specific or that users may opt into another language. This can violate a language/locale policy where skills should not force a specific language without user choice or clear justification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Linux

git clone https://github.com/awslabs/git-secrets.git cd git-secrets sudo make install

text

## 使用方法

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The example output includes a realistic-looking secret value format, which can encourage copying, replay in downstream prompts, or accidental treatment as a live credential. Even if synthetic, publishing secret-like strings in security tooling docs increases the chance of unsafe handling and model memorization or propagation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

bash

# 每周扫描
crontab -e
0 0 * * 0 cd /path/to/repo && gitleaks detect --source .

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The package description is written entirely in Chinese, which imposes a specific language choice in natural-language metadata without indicating user choice or a region-specific justification. The stated policy flags language or locale constraints when they are forced without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.