GitCode Release Notes

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:09 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent GitCode release-note generator that uses a required GitCode token to read repository commits, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Install only if you intend to let the skill read the specified GitCode repository using GITCODE_TOKEN. Use a least-privilege token with read_api/read_repository access, avoid running it with broad unrelated tools enabled, and treat commit messages as untrusted text to summarize, not instructions to follow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/release_notes.py:450

Finding

Untrusted commit messages are exposed to the Agent without prompt-injection defenses

Content

View full analysis

= 7 else sha, "url": base_url + sha, "message": msg.strip(), "first_line": first_line, "body": body, "type": t, "date": _commit_date(c), }) ``` The corresponding Skill workflow instructs the Agent to parse and summarize these fields: ```markdown 3. **Read JSON**: Parse JSON from stdout. 4. **Generate final release note**: - Classify, summarize, and polish JSON `commits`. ``` ### Technical Analysis Commit messages and bodies are externally sourced, repository-controlled data. A contributor who can introduce a commit can place natural-language instructions in these fields. The implementation preserves the complete commit message and body and emits them into JSON for subsequent processing by the Agent. Neither the script nor the Skill instructions establish a clear trust boundary stating that repository content is data only and must never be treated as instructions. There is also no normalization of control characters, explicit field-length limit for the complete message or body, or defensive instruction requiring the Agent to ignore commands embedded in commit content. This creates an indirect prompt-injection channel. Although the use of JSON provides structural separation, JSON encoding alone does not prevent a language model from interpreting text inside a value as an instruction. ### Attack Path ...[truncated 1880 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'req' from os.environ.get (line 106, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/release_notes.py (reported line 110)May include surrounding context.

python

last_err = None
    for attempt in range(RETRY_TIMES + 1):
        try:
            with urlopen(req, timeout=timeout_sec) as resp:
                time.sleep(REQUEST_SLEEP_SEC)
                raw = resp.read().decode("utf-8")
                return (json.loads(raw), None)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs execution of a local Python script that reads an access token from environment variables and calls the GitCode API, but it does not declare any explicit tool permissions or allowed tool scope. That creates an authorization gap where an agent may invoke shell, network, and env-dependent behavior without clear sandboxing or user-visible boundaries, increasing the chance of over-broad execution or secret exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document requires that section titles and item descriptions '统一用中文', which forces a specific language for all outputs. This is a natural-language policy concern because the skill does not offer the user a language preference or explain a justified region-specific restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/release_notes.py (reported line 26)May include surrounding context.

python

from urllib.error import HTTPError, URLError
from urllib.parse import urlencode

GITCODE_API_BASE = "https://api.gitcode.com/api/v5"
SCRIPT_DIR = Path(__file__).resolve().parent
SKILL_ROOT = SCRIPT_DIR.parent

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's stated purpose is to generate release notes from repository commits. Spawning PowerShell to read user- or machine-level environment variables is not a direct or necessary part of that purpose, especially when the process environment is already checked first; it introduces host introspection and subprocess execution unrelated to release-note generation itself.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release_notes.py (reported line 49)May include surrounding context.

python

if sys.platform != "win32":
        return None
    try:
        out = subprocess.check_output(
            [
                "powershell",
                "-NoProfile",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI description explicitly states the generated release notes are '默认中文', and the script's user-facing strings and markdown section headers are all hard-coded in Chinese. There is no option for the user to choose language or opt in to this locale behavior, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation states '默认中文' for output language, which is a natural-language locale constraint. Under the policy, locale/language restrictions should either offer user choice or be clearly justified as region-specific; this README does not provide such opt-in or justification.

Content

No source excerpt is available for this finding.