Git Toolkit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:54 AM UTC
• Version: 1.0.0

Overview

This Git utility skill is mostly coherent, but it needs review because its stats command handles repository filenames unsafely and can be tricked by a crafted repository into counting files outside the repository.

Review before installing if you work with untrusted repositories. Avoid running the stats command in repositories you do not trust until filename handling is hardened, and remember that ignore, undo, and fresh-branch intentionally modify local repository state when invoked.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/git_extras.sh:56

Finding

Unsafe Processing of Attacker-Controlled Git Filenames

Content

View full analysis

Vulnerability Details

File Location: scripts/git_extras.sh, line 56
Vulnerability Type: Option injection and unsafe filename parsing
Risk Level: Medium

Vulnerable Code

bash

echo "  Lines of code: $(git ls-files 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 | awk '{print $1}')"

Technical Analysis

The stats command obtains tracked filenames from git ls-files and passes them to xargs wc -l. Repository filenames are attacker-controlled when the skill is run against an untrusted repository.

The pipeline has two security defects:

1. It uses newline-delimited output instead of the NUL-delimited interfaces provided by git ls-files -z and xargs -0. Filenames containing spaces, quotes, backslashes, or newlines can therefore be split or interpreted incorrectly.
2. It does not place the -- end-of-options marker before filenames. A tracked filename beginning with - may consequently be interpreted as a wc option rather than as a path.

On implementations of wc supporting file-list options, a specially named tracked file such as --files0-from=payload can instruct wc to obtain additional paths from an attacker-prepared repository file. This may cause files outside the repository to be opened and counted.

There is no shell-command substitution or direct arbitrary command execution through this line because xargs invokes wc directly. The demonstrated risk is argument/option injection, unintended local-file access, malformed processing, and denial of service.

Attack Path

1. An attacker creates or supplies an untrusted Git repository.
2. The attacker commits a specially named file whose name is interpreted by wc as an option.
3. Where supported, the attacker also commits a payload file containing references to local paths that may exist on the victim's system.
4. A victim or automated agent runs scripts/git_extras.sh stats inside that repository.
5. git ls-files emits the attacker-controlled filenames.

...[truncated 1027 chars]

Remediation

View remediation

Remediation Suggestions

Use NUL-delimited filename handling and explicitly terminate option parsing:

bash

echo "  Lines of code: $(git ls-files -z 2>/dev/null |
    xargs -0 -r wc -l -- 2>/dev/null |
    tail -1 |
    awk '{print $1}')"

Additional hardening measures should include:

1. Verify that the deployed wc implementation honors -- before relying on this construction.
2. Prefer processing each NUL-delimited path through controlled logic if cross-platform behavior is required.
3. Reject paths outside the intended repository worktree after canonicalization.
4. Test the command with filenames containing spaces, quotes, newlines, leading hyphens, and option-like strings.
5. Consider implementing line counting in a language or API that opens filenames as data rather than converting them into command-line arguments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown states that most commands work without arguments and use defaults, but it does not disclose whether those defaults may affect repositories, files, or other user data. For a skill tips file, this can leave users unaware that invoking commands with no arguments may still perform meaningful actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.