Security audit

git-workflow

Security checks for vulnerabilities and agentic risk

Overview

This Git helper needs review because its recovery instructions can discard local changes or overwrite shared branch history without adequate safeguards.

Before installing, require backups and explicit approval for hard resets and remote history rewrites. Verify the branch, commit, and successful cherry-pick before removing anything; prefer reverting shared commits and use verified lease protection when rewriting history is necessary. The skill also commits split changes automatically by default, which can be disabled with GIT_FLOW_AUTO_SPLIT=false.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Wrong-branch recovery instructs a hard reset without warning that it discards uncommitted changes.

High

Category: Output Handling
Confidence: 98% confidence
Finding: The recovery sequence directs the agent to run 'git reset --hard HEAD~1' without checking for or preserving uncommitted changes, which can irreversibly discard tracked working-tree changes. It also assumes the misplaced commit is the branch tip and permits continuation without explicit success checks, making this otherwise legitimate recovery workflow unsafe.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The hard-reset command is a legitimate Git recovery operation, not evidence of malicious parameter injection, but its unguarded use can discard local changes and move the wrong branch tip. This is the same underlying destructive-recovery issue as SQP-2, not an independent vulnerability.
Content: Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.
git checkout git cherry-pick git checkout git reset --hard HEAD~1 # remove from wrong branch

text
3. **Verify**: `git log --oneline -3` on both branches.

Standalone triggers such as 'split' and 'staged' can activate the skill outside Git workflows.

Medium

Category: Trigger Abuse
Confidence: 97% confidence
Finding: The trigger list includes ordinary words such as 'split' and 'staged' without requiring Git context or an explicit command. These overlap with unrelated requests, and no exclusion conditions clarify when they should not activate the skill.
Content: No source excerpt is available for this finding.

The troubleshooting guidance recommends force-pushing without warning that it can overwrite remote history and discard collaborators' commits.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The troubleshooting guidance permits force-pushing to an owned branch without checking whether collaborators have added remote commits, potentially overwriting their work. Restricting this advice to non-main branches reduces the scope but does not make shared feature branches safe. Because this skill guides Git operations, an agent could apply this unsafe recovery advice directly.
Content: No source excerpt is available for this finding.