Security audit

Git Guardian

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed git workflow helper, but it can stage, commit, display, and push broad repository contents without strong safeguards.

Review this skill carefully before installing. It is not clearly malicious, but only use it in repositories where automatic branch, commit, and push behavior is acceptable, and ensure secrets and unrelated local files are ignored or removed before running its diff, commit, or finish commands.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/git-guardian.sh:72
Finding: Unrestricted Disclosure, Staging, and Remote Publication of Sensitive Files
Content: View full analysis
&1 ``` ### Technical Analysis The `diff` operation enumerates every non-ignored untracked file and prints its first 50 lines without inspecting its type, sensitivity, size, or ownership. A credentials file, private configuration, environment file, or other sensitive workspace artifact can therefore be disclosed directly in terminal output or any agent conversation that captures command output. The `commit` operation subsequently executes `git add -A`, staging all tracked modifications, deletions, and non-ignored untracked files in the entire repository. It does not restrict staging to files created or modified by the current agent operation, scan files for secrets, or verify that the user previously reviewed and approved the displayed diff. The `finish` operation pushes the resulting branch to the repository-configured `origin`. Consequently, sensitive files can progress from local untracked data to permanent Git history and remote publication. This behavior contradicts the documented assertion in `SKILL.md:50-53` and `README.md:55-58` that secrets are not tracked. The documented approval workflow is also advisory rather than technica ...[truncated 1896 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to provide a transparent, diff-first review workflow, but it also instructs the agent to create branches, commit changes, push to a remote, and provide review links. Those actions materially change repository and remote state, and pushing can exfiltrate code or sensitive modifications outside the local environment before the user has fully reviewed the consequences. The mismatch increases the chance that a user enables the skill expecting passive review support while the agent performs active, side-effecting git operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README says the skill 'activates automatically when the agent creates or modifies files' without narrowing the context, repository scope, command boundary, or exclusion conditions. Because file creation and modification are extremely common actions, this trigger description is broad enough to risk unintended or overly frequent invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation criteria are very broad, covering nearly any file creation or modification, config change, script work, or generic transparency request. In an agent setting, this can cause the skill to trigger during routine edits and automatically steer the workflow into branch creation, staging, committing, and possibly pushing, even when the user only intended a small local change. The surrounding context makes this more dangerous because the skill includes state-changing git operations rather than merely presenting diffs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promises a diff-first, review-before-apply workflow, but the commit command immediately runs 'git add -A' and 'git commit' after showing only a staged stat summary, not the full patch, and it does not verify that the user reviewed or approved the changes beforehand. In an agent setting, this can let unintended or harmful edits be silently bundled and committed, undermining the transparency and review guarantees the skill advertises.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The finish command pushes the current branch to 'origin', which goes beyond local tracking and review into external publication of changes. In a skill whose stated purpose is local transparency and review of agent work, this materially increases risk because sensitive code, configs, secrets, or unfinished changes may be exfiltrated to a remote repository with a single command.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Remote-push capability is not necessary for the core stated function of showing diffs and tracking local changes, so including it expands the skill's authority beyond its declared purpose. In an agent context, any unnecessary network-capable action is more dangerous because it can move workspace contents off-host and create an unauthorized disclosure path.
Content: No source excerpt is available for this finding.