Git Security Scanner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:47 AM UTC
• Version: 1.0.1

Overview

This security-scanning skill is mostly purpose-aligned, but it tells users to override an installation warning and relies on unpinned external scanner installs.

Review this skill before installing. Prefer pinned, verified versions of gitleaks and shipguard, avoid using --force unless you have independently verified the exact artifact, and be aware that scans and reports may expose repository secrets to the installed scanner tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73

Finding

Unpinned Third-Party Security Scanner Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–78
Vulnerability Type: Unpinned and insufficiently verified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash

pipx install shipguard  # or: pip install shipguard

# Linux
# gitleaks: download from https://github.com/gitleaks/gitleaks/releases
# shipguard:
pipx install shipguard

The same unpinned installation instruction is repeated at SKILL.md:233:

markdown

| `shipguard` not found | `pipx install shipguard` or `pip install shipguard` |

Technical Analysis

The installation instructions retrieve shipguard by package name without pinning an audited version or verifying a cryptographic hash or signature. Although SKILL.md:245 mentions version 0.3.2, the actual installation commands do not constrain installation to that version.

Consequently, the effective dependency can change after this Skill has been reviewed. Package-index compromise, maintainer-account compromise, malicious package replacement, or an unexpected future release could cause users to install code that was not included in this audit. A source distribution may also invoke package build tooling during installation, while installed command-line tools execute with the invoking user's permissions when subsequently used.

The gitleaks installation guidance similarly directs users to download a release but does not identify an immutable artifact, checksum, or signature.

Attack Path

1. An attacker compromises the package publisher, package-index entry, release source, or distribution channel.
2. The attacker publishes a malicious or backdoored package version under the expected package identity.
3. A user follows the documented pipx install shipguard or pip install shipguard command.
4. The package manager retrieves the current package selected by the index rather than a reviewed, immutable version.
5. Malicious code may ...[truncated 808 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, such as shipguard==0.3.2, after independently verifying that the package identity and version are correct.
2. Distribute a locked dependency manifest containing cryptographic hashes and require hash verification during installation.
3. Link to the exact official source repository and an immutable release tag or commit rather than a general publisher profile.
4. Publish and verify signed release artifacts or trusted provenance attestations.
5. For gitleaks, document the exact release version, platform artifact, expected SHA-256 digest, and signature-verification procedure.
6. Prefer isolated installation with pipx over installation into a shared Python environment, while recognizing that isolation does not eliminate access to user-readable data at runtime.
7. Review every dependency update before changing the pinned version and automate provenance, vulnerability, and integrity checks in the release process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:231

Finding

Forced Installation Recommended Despite Security Warning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 231
Vulnerability Type: Security-warning bypass for externally installed content
Risk Level: Medium

Vulnerable Code Snippet

markdown

| VirusTotal "suspicious" warning on install | This is a false positive — the skill *describes* secret patterns and vulnerability types, which triggers pattern detection. Use `clawhub install git-security-scanner --force` to proceed. Review the SKILL.md yourself to confirm. |

Technical Analysis

The documentation categorically characterizes a VirusTotal warning as a false positive and directs the user to bypass the installation safeguard with --force. However, the audited project contains only SKILL.md; the advertised git-security-scan wrapper script is not present and therefore could not be inspected or verified during this audit.

Reviewing only the documentation cannot establish that the separately delivered installation artifact is safe. The forced-install recommendation weakens a defense-in-depth control precisely when the platform has identified content requiring additional scrutiny. If the remotely distributed Skill package differs from the reviewed file or becomes compromised later, the recommendation can facilitate installation of unaudited executable content.

Attack Path

1. An attacker compromises, replaces, or publishes a malicious version of the externally distributed Skill package.
2. Antivirus or marketplace scanning marks the artifact as suspicious and the normal installation process presents or enforces a warning.
3. The user trusts the documentation's unconditional false-positive assertion.
4. The user executes clawhub install git-security-scanner --force, bypassing the installation safeguard.
5. The package installs content not represented by the sole file available in this audit.
6. If that content contains a malicious wrapper or hook, it may execute when the scanner is invoked or ...[truncated 600 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket statement that the warning is a false positive and do not recommend --force as the default remedy.
2. Require users to stop and verify the exact flagged artifact before overriding any warning.
3. Include every installed executable, especially the advertised git-security-scan wrapper, in the reviewable Skill package.
4. Publish a complete file manifest with SHA-256 hashes, signed releases, immutable source references, and reproducible build instructions.
5. Explain precisely which files and signatures trigger the warning and provide independent evidence supporting any false-positive determination.
6. If an override remains necessary, document a verification workflow that compares the downloaded artifact against a trusted signed release before using --force.
7. Re-submit corrected artifacts to relevant scanning providers instead of normalizing security-control bypasses.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.