ClawHub
Back to skill

Security audit

stack-rebase

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent stacked-PR rebase guide, but it can rewrite multiple remote branches and edit PR bases with broad activation triggers and limited safety gating.

Install only if you intentionally manage stacked PR branches and are comfortable with history rewrites. Before using it, verify the STACK pattern, list every branch and PR it will affect, fetch first, confirm no one else has pushed to those branches, and avoid shared or protected branches unless your team has agreed to the rewrite.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The looped use of 'git push --force-with-lease' across all matching stack branches can rewrite multiple remote branches in one operation. Although '--force-with-lease' is safer than '--force' and appropriate for rebased stacks, this is still a high-risk operation because incorrect branch selection, stale assumptions, or mis-triggering could mass-update remote history and disrupt reviews or collaborators.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

bash
for branch in $(git branch --list "${STACK}/*" \
    | sed 's/^[* ]*//' | sort); do
  git push --force-with-lease origin "${branch}"
  echo "force-pushed: ${branch}"
done

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
88% confidence
Finding

Using 'rebase' as a trigger collides with a common built-in Git concept/command and is likely to invoke this specialized stacked-diff workflow when the user only wants a normal rebase. Because the skill prescribes cascading history rewrites, accidental shadow activation can steer users toward much more invasive operations than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad terms like 'git', 'rebase', and especially 'pr', which can cause the skill to activate in contexts far beyond stacked-diff maintenance. Unintended activation is risky here because the skill contains branch-rewriting and force-push instructions that could be applied to the wrong repository state or user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to perform a cascading rebase and then force-push rewritten branches, but it does not present a prominent explicit warning that this rewrites commit history and can disrupt collaborators, invalidate reviews, or overwrite expected branch state. In a stack-management context, these actions are legitimate, but the absence of a clear safety gate materially increases the chance of damaging misuse.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
97% confidence
Finding

The trigger term 'pr' is extremely short and ambiguous, so it can match many unrelated pull-request workflows. In this skill, accidental invocation is more dangerous than usual because the prescribed actions include rebasing and force-pushing multiple branches.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:196