Git Repo Auditor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:02 PM UTC
• Version: 1.0.0

Overview

The skill mostly performs a local Git repository audit, but it can copy discovered secrets into terminal or JSON reports, which may spread credentials further.

Install only if you are comfortable with reports being treated as sensitive artifacts. Run it on repositories you are authorized to audit, avoid publishing or broadly sharing its terminal output or JSON reports, and rotate any credentials it finds. A safer version should redact matched secret values by default and report only type, location, commit, and remediation guidance.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:127
• Finding: Detected credentials are exposed in terminal and JSON reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:127-139`, `scripts/main.py:257-273`, and `scripts/main.py:277-283` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ### Vulnerable Code ```python # scripts/main.py:127-139 for pattern_name, pattern_regex in patterns.items(): matches = re.finditer(pattern_regex, content, re.IGNORECASE) for match in matches: issues.append({ "severity": "high" if "key" in pattern_name or "token" in pattern_name else "medium", "type": pattern_name, "commit": commit_hash, "date": date, "author": author, "file": filename, "match": match.group(0)[:50] + ("..." if len(match.group(0)) > 50 else ""), "line": content[:match.start()].count('\n') + 1, "remediation": f"Remove secret from history using git filter-branch or BFG" }) ``` ```python # scripts/main.py:257-273 if args.json: output = { "repository": os.path.abspath(path), "scan_date": datetime.now(timezone.utc).isoformat(), "repository_info": repo_info, "security_issues": secrets, "large_files": large_files, "health_metrics": health, "summary": { "total_security_issues": len(secrets), "total_large_files": len(large_files), "stale_branches": len(health["stale_branches"]), "binary_files": health["binary_files"], } } print(json.dumps(output, indent=2, default=str)) ``` ```python # scripts/main.py:277-283 if secrets: print(f"\n⚠️ SECURITY ISSUES FOUND ({len(secrets)}):") for i, issue in enumerate(secrets[:5], 1): print(f"{i}. {issue['severity'].upper()}: {issue['type']} found in commit {issue['commit'][:8]}") print(f" File: {issue['file']}") print(f" Match: {issue['match']}") print(f" Remediation: {issue['remediation']}") ``` ### Tech ...[truncated 2920 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the raw `match` value from issue records. Report only the pattern type, commit, file, and line number. 2. If correlation is required, replace the secret with an irreversible fingerprint such as a truncated SHA-256 digest computed locally. 3. If a visual indicator is necessary, use strict masking that does not reveal meaningful credential material, such as `[REDACTED]`. Avoid preserving prefixes or suffixes unless a particular credential format has been reviewed for safe disclosure. 4. Ensure both human-readable and JSON output use the same centralized redaction function so future output formats cannot accidentally bypass masking. 5. Add automated tests containing representative AWS, GitHub, Stripe, password, SSH-private-key, and generic-token fixtures. Assert that no complete fixture secret or substantial substring appears in output. 6. Document that audit reports contain sensitive repository metadata and should receive restrictive file permissions, limited retention, and access controls. 7. Recommend immediate credential rotation whenever a potential secret is found, because removing it from Git history alone does not invalidate it. A safer issue record would resemble: ```python issues.append({ "severity": "high" if "key" in pattern_name or "token" in pattern_name else "medium", "type": pattern_name, "commit": commit_hash, "date": date, "author": author, "file": filename, "match": "[REDACTED]", "line": content[:match.start()].count("\n") + 1, "remediation": ( "Rotate the credential immediately and remove it from Git history." ), }) ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Scanning large repositories may be slow
- Secrets detection uses regex patterns (may have false positives)
- Does not automatically remove secrets from history
- Requires local Git repository (cannot scan remote directly)

## License

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Scanning large repositories may be slow
- Secrets detection uses regex patterns (may have false positives)
- Does not automatically remove secrets from history
- Requires local Git repository (cannot scan remote directly)

## License

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes and demonstrates shell-capable execution (`python3 scripts/main.py ...`, requiring `git` and `python3`) but does not declare any explicit tool scope such as `permissions` or `allowed-tools`. This creates an authorization gap where an agent may invoke shell commands without clear least-privilege boundaries, increasing the risk of unintended command execution against arbitrary local repositories or paths.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_git_command(args: List[str], cwd: str = None) -> str:
    """Run git command and return output."""
    try:
        result = subprocess.run(
            ["git"] + args,
            cwd=cwd,
            capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The tool prints matched secret material (`issue['match']`) directly to console/JSON output, even if truncated, which can leak valid credentials into terminal history, logs, CI artifacts, screenshots, or downstream systems consuming the report. In the context of a repo-auditing skill, this is particularly risky because the application is explicitly designed to discover secrets, so it materially increases the chance of re-exposing sensitive data that should be handled minimally.

Static analysis

No suspicious patterns detected.