mobile-merge-request

• Outcome: Pass
• Latest audit: Oct 27, 2026 · 10:08 AM UTC
• Version: 1.0.1

Overview

This skill provides a coherent mobile pull-request workflow, though its Git setup commands change preferences across all your repositories.

Prefer repository-local Git settings unless you want the suggested defaults across all repositories. Review proposed history rewrites, force pushes and merges before approving them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (12)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash

# BAD
git push --force                  # overwrites whatever is on the remote, including others' commits
git rebase origin/main            # on main, develop or a branch a colleague also pushes to

# GOOD: own branch only, refuses if the remote moved since your last fetch

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

Suggested commands

bash

git rebase -i --autosquash origin/main
git push --force-with-lease

Verdict

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/conflicts.md (reported line 131)May include surrounding context.

md

- [ ] No conflict markers (`git diff --check`)
- [ ] Lockfiles and generated code regenerated, not hand-edited
- [ ] Build and tests green for every affected platform
- [ ] `git range-diff origin/main @{u} HEAD` reviewed before `git push --force-with-lease`
- [ ] Non-trivial resolutions mentioned in an MR comment so reviewers can check them

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/git-commands.md (reported line 54)May include surrounding context.

git fetch origin git rebase origin/main # own branch only git range-diff origin/main @{u} HEAD # compare pushed commits with rebased commits git push --force-with-lease # refuses if someone else pushed since your fetch

text

- `git range-diff` shows per-commit differences between the old and new series. Use it before every

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mr-template.md (reported line 54)May include surrounding context.

md

## Risk and rollback
- Risk: <!-- what could break, which users, which app versions -->
- Migration: <!-- database, preferences, keychain, payload format; none if none -->
- Rollback: <!-- revert this MR | turn off flag X | server-side switch -->

## Platform and compliance notes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

• Lockfiles, project.pbxproj and version catalogs have specific procedures: conflict resolution.

9. The description lets a reviewer review without asking

markdown

<!-- BAD -->

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

text

- Every user-visible change has Android and iOS screenshots or recordings, before and after.
- Call out explicitly: new permissions, manifest or `Info.plist` keys, entitlements, `minSdk`,
  `targetSdk` or deployment target changes, database migrations, analytics or telemetry changes.
- Full template: [MR template](references/mr-template.md).

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

- [ ] Self-reviewed: no debug logs, commented-out code, secrets, personal data or unrelated files
- [ ] Build, lint and tests pass for every affected platform after the last rebase or conflict fix
- [ ] Description has Summary, Ticket, Changes, screenshots (Android and iOS), Testing, Risk and rollback
- [ ] Permissions, manifest, `Info.plist`, entitlements, SDK levels and migrations are called out
- [ ] Review fixes are fixup commits; history is cleaned before merge
- [ ] Force pushes use `--force-with-lease`, on the author's own branch only
- [ ] Every review thread has a reply; resolved by the agreed party

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

Fix: git commit --fixup=<target> or reword before merge. 2. [Must fix] Description has no iOS screenshots for a shared UI change. 3. [Should fix] Gradle wrapper bump mixed with feature code -- split into its own MR. 4. [Note] Info.plist gains NSBluetoothAlwaysUsageDescription -- call it out under Risk.

Suggested commands

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/conflicts.md (reported line 123)May include surrounding context.

md

## iOS resources

- `Localizable.xcstrings` is JSON: keep both sides' keys, then confirm it still parses by building.
- `Info.plist` and entitlements: keep both sides' keys and call out the result in the MR description.
- Asset catalogs (`Contents.json`): keep both entries; duplicated asset names fail the build.

## After resolving

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/mr-template.md (reported line 60)May include surrounding context.

md

## Platform and compliance notes
<!-- Delete lines that do not apply. -->
- New permissions / manifest entries:
- `Info.plist` keys / entitlements / background modes:
- `minSdk` / `targetSdk` / `compileSdk` / deployment target:
- Privacy manifest (`PrivacyInfo.xcprivacy`) / data safety form impact:
- Telemetry or analytics payload changes (personal data?):

The setup commands change persistent, user-wide Git settings without warning that they affect other repositories.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The setup commands persistently change user-wide Git defaults, affecting unrelated repositories without an explicit scope warning or approval requirement. These are legitimate workflow preferences rather than malicious settings, but silently applying them can cause unexpected pull, rebase, push, and conflict-resolution behavior outside the intended project.

Content

No source excerpt is available for this finding.