git-repo

• Outcome: Review
• Latest audit: Sep 1, 2026 · 10:55 PM UTC
• Version: 0.10.1

Overview

The skill is useful Git/SourceGit automation, but it needs Review because some workflows can change repositories, GUI settings, and credential behavior with too little confirmation.

Install only if you want an agent to manage local Git repositories and SourceGit state. Before using mutating topics, require a dry run or explicit confirmation, back up SourceGit preference.json and ~/.gitconfig, avoid token-in-URL clone fallbacks when possible, and inspect any migration/deletion paths before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The clone workflow goes beyond cloning and SourceGit registration by automatically appending ignore rules to the repository's .gitignore. This silently changes project state and may alter tracked-file behavior or create unintended commits, especially because it happens without confirmation in a workflow triggered by ordinary clone requests.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The workflow retrieves an auth token and embeds it directly into a clone URL, which risks credential exposure through shell history, process listings, logs, crash reports, or accidental copy/paste. Although the token is later removed from origin, exposure can already have occurred during command construction and execution.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The topic promises to be read-only and 'audit-only', but later instructs modifying staged content and performing branch repair with `git reset --mixed`. This mismatch is dangerous because an agent or user may rely on the safety claim and authorize the skill in situations where state-changing repository operations are not acceptable, leading to unintended ref/index modifications during a sensitive rebase or recovery workflow.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file expands from an active-rebase audit into a separate post-rebase branch-pointer repair workflow, which changes the operational scope and threat model mid-document. That makes misuse more likely: an agent invoked for a supposedly narrow audit task may proceed into broader branch-repair actions involving PR lookups and resets, increasing the chance of unexpected repository modifications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that ghq clone automatically registers repositories in SourceGit and creates groups 'without user confirmation'. That means a routine clone action also mutates GUI client configuration and persistent workspace metadata, which can surprise users, alter trust boundaries, and potentially register attacker-controlled repository paths or misleading groups in a developer tool.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This workflow explicitly modifies .gitignore automatically and the skill later states it proceeds without user confirmation. Silent file modification in a clone flow violates least surprise and can introduce persistent repository changes the user did not request.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow reads and edits SourceGit's preference.json to register repositories, creating persistent user-configuration changes without adequate warning or consent. Because this affects local application state outside the cloned repository, accidental or incorrect edits can disrupt tooling, overwrite organization, or create hard-to-debug configuration issues.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs users to add a shell-evaluated Git credential helper in ~/.gitconfig that dynamically prints authentication material, but it does not warn that Git `helper = !...` executes shell code from config or that this path handles highly sensitive tokens. In context the goal is legitimate account-scoped authentication, but normalizing shell helpers for credentials without explicit security guidance increases the risk of unsafe copy/paste, config abuse, token exposure through debugging or process inspection, and long-lived insecure patterns in a user’s global environment.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic terms like 'doctor' and 'check hooks', which can cause the skill to activate in unrelated contexts and operate on repositories when the user did not specifically intend this skill. In an agent environment, over-broad invocation increases the chance of unintended command suggestions or repository inspection, expanding the skill's effective attack surface and enabling prompt/behavior hijacking through ambiguous phrasing.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The document states that the repair flow will automatically launch SourceGit on the recovered worktree, but it does not present this as a clear warning or require explicit user acknowledgement. Auto-launching a GUI application from a repair script can have unexpected side effects in automation, remote sessions, or untrusted repository contexts, and may surprise users into opening attacker-controlled content or executing local tool integrations they did not intend to run.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The procedure instructs the user to remove an old directory for an orphaned worktree without an explicit inline warning that uncommitted changes or untracked files could be lost. In a worktree-management context this is more dangerous because these directories often contain active branch state, making accidental data loss plausible during routine maintenance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This procedure deletes the `.git` pointer file, removes the old worktree directory, and prunes worktree metadata without clearly warning that the operation is irreversible from the original worktree's perspective. Even though the workflow aims to preserve contents in a new standalone repo, mistakes in paths or incomplete moves could permanently sever metadata or lose local state.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger examples include broad phrases like "check all repos," which can cause the skill to activate in routine conversations without clear user intent. In this skill, unintended activation is more dangerous because it enumerates repositories, performs network fetches, and presents destructive follow-up actions such as stashing, discarding changes, or pushing commits.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger condition fires on the bare mention of "sourcegit" or "SourceGit", which is overly broad for a skill that can read and modify a user configuration file and rename folders. This can cause the agent to invoke file-editing behavior in contexts where the user is only discussing the product, increasing the chance of unintended configuration changes or unsafe command execution without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The procedure performs destructive path moves and Git metadata rewiring (`mv <repo> <target-path>`, extracting `.git`, marking the repository bare, and manually relinking worktree metadata) without an explicit backup/rollback warning before conversion. If the operator supplies the wrong paths, targets an existing directory, or the process is interrupted mid-sequence, the repository can be left in a broken state or appear lost, especially because the original path disappears immediately.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs moving and restructuring repositories, including converting worktree/bare layouts, without an explicit warning that these are state-altering operations that can disrupt local changes if the operator targets the wrong repository or path. In a repo-management skill, omission of a clear confirmation/safety checkpoint increases the chance of accidental data loss or workspace breakage, especially because migration changes repository location and metadata.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The instructions append entries directly to .gitignore, which modifies tracked repository content, but do not clearly warn the operator that this changes the repo and may create an unintended commit diff. While not inherently malicious, silent file modification in an automation skill can surprise users and alter project configuration without explicit consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The batch migration guidance says to delete repositories after comparison when duplicates are found, but it lacks a prominent safety warning and explicit confirmation gate before deletion. In bulk workflows, even a small mistake in comparison or path selection can lead to irreversible loss of branches, stashes, or unpushed work.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls -la <src>/.git

# If .git is a file (gitdir pointer), delete it
rm -f <src>/.git

# If .git is a directory (actual repository):
#   - Verify tags were transferred to dst

• Confidence: 94% confidence
• Finding: The workflow instructs deletion of <src>/.git using rm -f after only a manual type check, which is dangerous because the placeholder path is unconstrained and a mis-substituted or malformed value could destroy repository metadata for the wrong directory. In an agent skill context, destructive shell commands against user-supplied paths are especially risky because automation may execute them without sufficient validation or rollback.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# If .git is a directory (actual repository):
#   - Verify tags were transferred to dst
#   - git -C <dst> tag -l | grep merge-backup
#   - After verification: rm -rf <src>/.git (AskUserQuestion required)

# Remove empty folders (bottom-up)
find <src> -type d -empty -delete

• Confidence: 98% confidence
• Finding: The commented instruction to run rm -rf <src>/.git is a high-risk destructive operation that can recursively erase an entire repository metadata directory if the path is incorrect, symlinked, or points somewhere unintended. Even though the text says AskUserQuestion is required, the skill still embeds a hazardous command pattern that an agent or user may follow, and the repository-management context makes accidental data loss more likely, not less.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf .git/worktrees
  else
    # No other worktrees - move bare repo (clean up worktrees dir)
    rm -rf "$bare_repo/worktrees" 2>/dev/null
    mv "$bare_repo" .git
  fi

• Confidence: 80% confidence
• Finding: The script resolves `bare_repo` from `.git/commondir` data and then executes `rm -rf "$bare_repo/worktrees"` before moving the repo. Because `.git` metadata in the current repository is treated as trusted, a malicious or tampered repository can point `bare_repo` at an unintended filesystem location, causing recursive deletion of a `worktrees` subdirectory outside the expected Git storage area. In a repository-migration skill that operates on attacker-controlled repos, this trust boundary makes the deletion more dangerous.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.