Security audit

Svn Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent SVN helper, but it includes under-warned commands that can delete local work or cached SVN credentials and an unsafe certificate-trust bypass example.

Review before installing or using this skill in an agent that can run commands automatically. Require explicit approval before commits, deletes, recursive reverts, cleanup operations, or auth-cache changes, and avoid `--trust-server-cert` unless the certificate has been verified through a trusted channel.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: examples/README.md:191
Finding: Unsafe SVN Server Certificate Trust Bypass
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: examples/README.md:206
Finding: Overbroad Recursive Deletion of SVN Authentication Cache
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes svn revert --recursive . and svn cleanup --remove-unversioned, which can silently discard local changes or delete unversioned files without prominent warnings. In an agent-driven workflow, these commands are especially risky because they can cause immediate, unrecoverable data loss if run on the wrong path or without user awareness.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · config/README.md (reported line 25)May include surrounding context.
*.o *.pyc pycache/ .env .env.local

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · config/README.md (reported line 26)May include surrounding context.
*.pyc pycache/ .env .env.local

text
### 2. 提交模板 (commit-template.txt)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/README.md (reported line 144)May include surrounding context.
md
# 设置忽略规则 echo "*.log" > .svnignore echo "node_modules/" >> .svnignore echo ".env.local" >> .svnignore # 应用忽略规则 svn propset svn:ignore -F .svnignore .

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · examples/README.md (reported line 206)May include surrounding context.
bash
# 清除缓存的认证信息 rm -rf ~/.subversion/auth/* # 重新认证 svn update

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · examples/README.md (reported line 206)May include surrounding context.
bash
# 清除缓存的认证信息 rm -rf ~/.subversion/auth/* # 重新认证 svn update

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section documents destructive SVN operations such as delete, move, and branch-copy actions that can alter repository contents or history-adjacent structure, but it does not clearly warn about irreversible consequences once committed. In an agent skill context, users may invoke these commands through automation, increasing the chance of accidental deletion or unintended repository modifications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README labels a section as '安全操作' yet includes svn checkout --trust-server-cert, which disables or weakens certificate-validation safeguards during first connection. This can normalize unsafe behavior and expose users to man-in-the-middle attacks against SVN credentials and code provenance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Recommending trust of the server certificate without a warning about TLS-validation risk teaches users to bypass transport security checks. In the context of a version-control tool, that can enable interception of credentials or tampering with repository content during checkout or update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The command rm -rf ~/.subversion/auth/* irreversibly deletes cached authentication material, but the example provides no warning about losing stored credentials or affecting all SVN profiles on the machine. While not an exploit by itself, it encourages a destructive recovery step without safety context and can cause credential loss or operational disruption.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description is written only in Chinese ("代码版本控制工具"), which indicates a language-specific presentation without any visible user choice or opt-in. The policy requires avoiding forced language or locale constraints unless the skill explicitly offers a language choice or documents a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing instructional content in this file is Chinese, and there is no indication that the skill supports multiple languages or that Chinese is a justified region-specific requirement. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.