Git as Memory

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

The skill is a transparent Git-based memory workflow, but users should install its external CLI carefully because the setup examples do not pin package versions.

Before installing, verify the git-as-memory package source and publisher, prefer an exact pinned version, avoid global installation where a project-local install will work, and do not store secrets or credentials in memory entries.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

If missing, install one of:

```bash
npm install -g git-as-memory
pip install git-as-memory

No global install:

bash

npx git-as-memory --help
python -m git_as_memory.cli --help

text

### Technical Analysis

The documented installation commands resolve `git-as-memory` from npm or PyPI without pinning an exact, previously reviewed version or verifying package integrity. Consequently, the code installed can change after this skill has been audited.

In particular, `npx git-as-memory --help` may download and immediately execute the registry package when it is not already available locally. The instructions do not provide a lockfile, cryptographic hash, trusted version, package-signature verification process, or canonical publisher identity. A compromised publisher account, package takeover, registry compromise, or malicious future release could therefore introduce arbitrary code into this workflow.

The registries and package names shown are not themselves evidence of malicious intent. The vulnerability is the unsafe and non-reproducible dependency acquisition process.

### Attack Path

1. An attacker compromises the relevant npm or PyPI publisher account, takes over the package, or causes a malicious release to be served under the expected package name.
2. The attacker publishes a version containing malicious installation hooks or runtime behavior.
3. A user or agent follows the setup instructions without specifying a reviewed version.
4. npm, pip, or npx resolves and retrieves the attacker-controlled release.
5. Package installation hooks or the invoked CLI execute with the permissions of the user running the command.
6. The malicious package can access resources available to that user before the compromise is detected.


...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an exact reviewed release, for example git-as-memory@X.Y.Z for npm or git-as-memory==X.Y.Z for pip.
2. Prefer a project-local dependency managed by a committed lockfile instead of a global installation.
3. For npm, commit lockfile integrity metadata and use a reproducible installation mechanism such as npm ci.
4. Avoid automatic npx downloads. Require a verified local installation or use an explicitly pinned package version.
5. For Python, use an exact-version requirements file with cryptographic hashes and install with pip --require-hashes.
6. Document the canonical package publisher and source repository so operators can verify package provenance.
7. Validate downloaded artifacts against published checksums or signatures before execution.
8. Run the dependency with the minimum necessary filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill recommends running npx git-as-memory --help without pinning a specific package version. npx may fetch and execute the latest published package from the registry, so a compromised upstream package, typo-squatted name, or malicious new release could lead to arbitrary code execution on the agent host. In this skill context, the command is presented as setup guidance for agents that can run shell commands, which increases practical risk because users may execute it directly in trusted development environments.

Content

No source excerpt is available for this finding.