Git Repo Auditor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:02 PM UTC
• Version: 1.0.0

Overview

The skill mostly performs a local Git repository audit, but it can copy discovered secrets into terminal or JSON reports, which may spread credentials further.

Install only if you are comfortable with reports being treated as sensitive artifacts. Run it on repositories you are authorized to audit, avoid publishing or broadly sharing its terminal output or JSON reports, and rotate any credentials it finds. A safer version should redact matched secret values by default and report only type, location, commit, and remediation guidance.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:127

Finding

Detected credentials are exposed in terminal and JSON reports

Content

View full analysis

50 else ""), "line": content[:match.start()].count('\n') + 1, "remediation": f"Remove secret from history using git filter-branch or BFG" }) ``` ```python # scripts/main.py:257-273 if args.json: output = { "repository": os.path.abspath(path), "scan_date": datetime.now(timezone.utc).isoformat(), "repository_info": repo_info, "security_issues": secrets, "large_files": large_files, "health_metrics": health, "summary": { "total_security_issues": len(secrets), "total_large_files": len(large_files), "stale_branches": len(health["stale_branches"]), "binary_files": health["binary_files"], } } print(json.dumps(output, indent=2, default=str)) ``` ```python # scripts/main.py:277-283 if secrets: print(f"\n⚠️ SECURITY ISSUES FOUND ({len(secrets)}):") for i, issue in enumerate(secrets[:5], 1): print(f"{i}. {issue['severity'].upper()}: {issue['type']} found in commit {issue['commit'][:8]}") print(f" File: {issue['file']}") print(f" Match: {issue['match']}") print(f" Remediation: {issue['remediation']}") ``` ### Tech ...[truncated 2920 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

md

- Scanning large repositories may be slow
- Secrets detection uses regex patterns (may have false positives)
- Does not automatically remove secrets from history
- Requires local Git repository (cannot scan remote directly)

## License

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md

- Scanning large repositories may be slow
- Secrets detection uses regex patterns (may have false positives)
- Does not automatically remove secrets from history
- Requires local Git repository (cannot scan remote directly)

## License

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes and demonstrates shell-capable execution (python3 scripts/main.py ..., requiring git and python3) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke shell commands without clear least-privilege boundaries, increasing the risk of unintended command execution against arbitrary local repositories or paths.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python

def run_git_command(args: List[str], cwd: str = None) -> str:
    """Run git command and return output."""
    try:
        result = subprocess.run(
            ["git"] + args,
            cwd=cwd,
            capture_output=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tool prints matched secret material (issue['match']) directly to console/JSON output, even if truncated, which can leak valid credentials into terminal history, logs, CI artifacts, screenshots, or downstream systems consuming the report. In the context of a repo-auditing skill, this is particularly risky because the application is explicitly designed to discover secrets, so it materially increases the chance of re-exposing sensitive data that should be handled minimally.

Content

No source excerpt is available for this finding.