commit-tidy

• Outcome: Review
• Latest audit: Aug 18, 2026 · 5:56 AM UTC
• Version: 0.5.4

Overview

The skill mostly fits its Git commit-tidying purpose, but it includes an under-disclosed commit-review hook and high-impact history-rewrite push procedures that should be reviewed before installation.

Install only if you are comfortable with a skill that can guide commit rewriting, force-push workflows, GitHub repo checks, and repo-local rule inspection. Before enabling it, verify whether artifact/resources/commit-review-trigger.sh will be registered as a hook; if so, require explicit opt-in before any post-commit code-review subagent is launched or given repository context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a true vulnerability if the skill contains undisclosed behavior that watches commit executions, parses tool output, and triggers a separate code-review subagent with repository path and commit SHA. That materially exceeds the declared scope of merely advising on commit hygiene, which breaks user expectations, can cause unintended data flow to another agent, and may invoke side effects without explicit consent.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This hook causes the skill to initiate a separate code-review workflow after detecting a successful git commit, which is outside the declared scope of a commit-tidying skill. Even though it only prints a trigger instruction rather than directly executing the subagent, it creates an undeclared cross-agent side effect that can surprise users, expand data exposure to another agent, and bypass least-privilege expectations for the skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file's actual behavior is to monitor Bash tool activity, detect successful git commits, and emit instructions to launch a code-reviewer agent, which does not match the stated purpose of analyzing and recommending commit split/squash/message strategies. This mismatch is dangerous because users and reviewers may grant the skill access based on its declared purpose while hidden operational behavior introduces unintended automation and potential disclosure of repository context to another agent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad trigger phrases like common commit-related requests can cause the skill to activate in routine conversations where the user did not intend to invoke this workflow. In the context of a skill that can recommend or drive git-history rewriting steps, overbroad activation increases the chance of accidental execution paths, confusion, or unintended repository operations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs a history-rewriting force push on an already-pushed branch but does not explicitly warn about the risk of overwriting collaborators' work or the need for coordination before rewriting shared history. Even with `--force-with-lease` and a CI check, an autonomous agent following these steps could disrupt teammates or remove remote commits if branch state assumptions are wrong.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill explicitly instructs users to perform a history rewrite and then `git push --force-with-lease`, but the force-push section itself lacks a direct warning that this can overwrite shared remote history and disrupt collaborators. Although earlier sections mention not to use this on already pushed/shared commits, separating the hazardous action from an explicit local warning increases the chance of unsafe use when users skim to the execution steps.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file explicitly states that newly tracked sensitive files must be checked for language and audience, including that 'workspace-local Korean rules never belong in a PUBLIC repo commit.' This imposes a language-specific policy without user opt-in or a clearly justified security basis, which can cause the agent to block or alter legitimate commits based on locale rather than actual risk. In a commit-management skill, that creates workflow manipulation and inconsistent behavior around sensitive content review.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| # | Don't | Do |
|---|-------|-----|
| 1 | Apply the global "`.md` behavior-change addition ⇒ `feat:`" rule without checking the working tree's `.claude/rules/` | Run the self-check (`find <repo>/.claude/rules/ -name '*.md'`) first. If a local mapping exists, defer to it |
| 2 | Treat the local rule as "informational only" and stick with the global default | Local rule overrides the global default. The override is the source of truth for the commit type, not a suggestion |
| 3 | Add an HARD STOP / Don't-Do row to an existing topic and prefix `feat(skill-X):` autonomously | Inspect the diff for "new topic file / new SKILL.md Topics-table row." None? → look for the local rule's classification (`fix` / `chore` / etc.). Many → `feat:` only when a topic file actually appears |
| 4 | Self-check the local rule once per session and assume it still holds for later commits | The diff scope changes per commit. The classification is per-commit, not per-session |

• Confidence: 88% confidence
• Finding: find <repo>/.claude/

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Per git.md: force push requires CI status check (HARD STOP)
gh run list --branch <branch-name> --limit 5 --json status,conclusion
# Only force push after CI is clean or no runs exist
git push --force-with-lease origin <branch-name>
```

### Step 4. Cleanup

• Confidence: 90% confidence
• Finding: git push --force; non-interactive

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.