Security audit

Gitlog

Security checks for vulnerabilities and agentic risk

Overview

This skill is marketed as a Git history tool, but it mainly stores whatever the user types into persistent local log files, so it needs review before installation.

Install only if you want a local, persistent developer activity logger rather than a true Git history analyzer. Avoid entering secrets, tokens, private incident details, or sensitive repository notes, and review or delete ~/.local/share/gitlog if you stop using it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a Git history viewing/reporting tool, but the documented behavior is actually a persistent local logger that stores arbitrary user-provided input and activity history. This mismatch is dangerous because users may provide sensitive repository notes, review comments, branch details, or operational context under the assumption of transient Git inspection, while the tool instead creates a durable data trail and expands scope far beyond its stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest advertises a read-only repository inspection utility, but the documented functionality stores arbitrary entries locally and supports later export. That kind of semantic deception can cause users or higher-level agents to authorize use in contexts where persistence is not acceptable, resulting in unintended retention of potentially sensitive development data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation does not perform any Git history inspection despite advertising Git commit analysis functionality. Instead, it creates a generic persistent logging tool that stores arbitrary user input under the user's home directory, which is a strong capability mismatch and can mislead users into disclosing data they would not expect to be retained.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented command surface extends well beyond commit-history viewing into generic logging, template tracking, fixes, conversions, and activity monitoring. This overbroad capability increases the chance that the skill is invoked in inappropriate contexts and that users submit sensitive operational text unrelated to Git history, which is then retained locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that commands are logged and persisted, but the warning is not prominent or specific enough for a tool marketed as a Git history viewer. Users may enter sensitive commit-review notes, branch comparisons, or explanatory text without realizing all inputs and command activity are stored in ~/.local/share/gitlog/, creating avoidable local data exposure and retention risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The branding and description present the script as a Git-focused utility, but the code implements a generic devtools logger with no Git interaction. This deceptive or misleading packaging increases the risk that the skill is invoked in trusted workflows where users assume repository analysis is occurring while unrelated data collection is happening instead.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The export feature aggregates all stored log contents into new files on disk, potentially multiplying exposure of previously collected user data, yet provides no warning about what will be copied. This expands the persistence surface and makes later disclosure easier through a single export artifact.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Multiple commands append arbitrary user-provided text directly into persistent log files without any need tied to the stated Git-log viewing purpose. In an agent skill context, users may pass sensitive repository notes, tokens, incident details, or other secrets expecting analysis, and the script silently retains them on disk for later exposure through status, recent, search, or export operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command path stores user input to '$DATA_DIR/check.log' and mirrors it into 'history.log' without warning the user that their input will be written to disk. In the skill context, this is more dangerous because users interacting with a purported Git analysis tool are unlikely to expect persistent local retention of whatever text they provide.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The documentation asserts that data never leaves the machine, but in the same section it advertises export to JSON, CSV, or plain text for sharing or archival. While export itself is local, presenting export for sharing undermines the absolute claim that data never leaves the machine because the tool explicitly facilitates moving data out.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.