Security audit

Git Guardian

Security checks across malware telemetry and agentic risk

Overview

Git Guardian is a disclosed git workflow helper, but users should review diffs carefully because it can stage all repository changes and push branches to a remote.

Install this only for repositories where you want the agent to manage git branches, commits, and pushes. Before running commit or finish, inspect git status, the full diff, untracked files, and the origin remote, and make sure secrets, generated files, and unrelated local edits are excluded.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill’s stated purpose is transparency around file changes, but the documented workflow also authorizes higher-risk actions such as automatic staging of all changes, branch creation, and pushing to a remote. Those behaviors can affect unrelated repository state, publish sensitive or unintended changes, and create side effects beyond merely showing a diff, especially because `git add -A` and `git push` operate on the whole repo rather than the specific user-approved edits.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is framed as a local diff-first review aid, but the finish command can publish the current branch to a remote repository. In an agent setting, this creates a real data-exfiltration path because reviewed or unreviewed workspace contents may be transmitted off-host, which goes beyond the stated transparency purpose.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Remote publication is not necessary to satisfy the advertised goal of tracking changes and showing diffs before apply. Because the capability exceeds the stated purpose, it increases the chance that an agent or user invokes the skill expecting local review only while actually sending repository data to an external service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The commit command uses git add -A, which stages all modified, deleted, and untracked files in the repository without narrowing scope or warning the user. In a workspace used by an agent, this can silently capture unrelated files, secrets, generated artifacts, or user data and commit them, making later publication or sharing much more dangerous.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The finish command performs git push origin "$BRANCH" immediately, with no confirmation or warning that repository contents are being sent to a remote service. Combined with the broad staging behavior, this can rapidly turn local mistakes into external disclosure of code, credentials, or sensitive documents.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal