ClawHub
Back to skill

Security audit

Gitrama — Git History Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill should be reviewed because it installs an external CLI that automatically sends git history, diffs, and other repository context to a third-party AI service.

Install only if you are comfortable sharing repository history, diffs, staged changes, branch and contributor information with api.gitrama.ai. Avoid using it on private or regulated codebases unless your organization approves that service, and consider pinning and separately auditing the `gitrama` PyPI package before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned and Unaudited PyPI Dependency

Content
View full analysis
Remediation
View remediation
``` 2. Distribute a lock file or requirements file containing cryptographic hashes and install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Re-audit the dependency source and transitive dependencies whenever the pinned version changes. 4. Publish or vendor the relevant source so the behavior of `gtr` can be reviewed together with the skill. 5. Install and execute the package in an isolated, least-privilege environment without unnecessary credentials or filesystem access. 6. Use automated dependency monitoring and verify package provenance, release signatures, and publisher ownership where supported. ]]>

other

Warning
Location
SKILL.md:42
Finding

Automatic Transmission of Repository Context to an External Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly states that local git context is gathered and sent to api.gitrama.ai, but it does not clearly warn users that commit history, diffs, branch names, author metadata, or staged changes may contain sensitive proprietary or secret material. In a codebase context, this omission is dangerous because users may unknowingly transmit confidential source code, credentials, internal ticket names, or personal data to a third-party service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README presents invocation examples like "check what's changed in this repo" and "Generate a commit message" as free-form requests, but it does not define precise trigger scope, required context, or negative examples. In a conversational assistant, these generic phrases could unintentionally match ordinary user requests and cause the skill to activate more broadly than intended.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell commands (gtr, git, pip, curl) and its metadata explicitly requires binaries, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent can execute shell actions more broadly than intended, making command execution and unintended repository interaction harder to constrain or audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases include broad terms like "what happened", "repo summary", and "who changed", which can match many normal developer requests and cause this skill to activate unexpectedly. Because the skill performs shell-backed repository inspection and sends collected context to a remote API, over-broad routing can lead to unintended data exposure or use outside the user's expected scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill mentions server-side AI processing but does not prominently and clearly warn that repository contents, including commit history, diffs, branch information, and file tree context, are transmitted off-machine. In a codebase context this can expose proprietary source changes, secrets accidentally committed, internal URLs, or sensitive development history to a third-party service without meaningful informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This skill depends on communicating with an external domain for core functionality, and the surrounding documentation shows direct network interaction with api.gitrama.ai. In context, the external transmission is especially sensitive because the tool collects git history and diffs locally first, so the remote endpoint may receive confidential repository intelligence.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

If connection errors occur:

bash
# Verify api.gitrama.ai is reachable
curl -s https://api.gitrama.ai/health

Links

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · script/verify.sh (reported line 49)May include surrounding context.

sh
fi

# Check api.gitrama.ai connectivity
if curl -s --max-time 5 https://api.gitrama.ai/health &> /dev/null; then
    echo "✅ api.gitrama.ai is reachable"
else
    echo "⚠️  Cannot reach api.gitrama.ai — check your network connection"