ClawHub

Git Helper

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Git helper whose risky Git operations are disclosed and aligned with its purpose, with safety rules requiring confirmation for destructive actions.

Install this only if you want an agent to help operate Git repositories. Before allowing commits, pushes, rebases, hard resets, or force pushes, review git status, diffs, staged files, target branch, and remote, and give explicit approval for any destructive or history-rewriting action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow documents force-push and destructive history-editing operations with only minimal qualification and without a clear warning about irreversibility, coordination risks, or possible loss of commits. In an agent skill context, this can lead an automated assistant to suggest or perform unsafe git operations that rewrite shared history or discard user work.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The `git reset --hard HEAD~1` example is inherently destructive and permanently removes the last commit and local working-tree changes, yet the reference presents it without an explicit warning or recovery guidance. In a skill used for automation, this increases the chance that an agent recommends or executes irreversible data loss on behalf of the user.

VirusTotal

No VirusTotal findings

View on VirusTotal