ClawHub
Back to skill

Security audit

Git Workflows

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Git documentation skill with expected but potentially destructive Git recovery and cleanup examples, not hidden or malicious behavior.

Install this as a Git reference skill only if you are comfortable reviewing commands before running them. Be especially careful with `git reset --hard`, `rm -rf .git/modules/...`, and `git stash clear`: check `git status`, confirm the exact branch/ref/path, and make a backup branch or stash before using destructive examples.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes destructive history-rewriting and working-tree-reset commands such as `git reset --hard` in a recovery section without prominently warning that uncommitted changes will be discarded and rewritten history can disrupt collaborators. In a developer-assistant context, users may copy commands directly, so omission of safety guidance creates a realistic risk of accidental data loss.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The submodule removal instructions include `rm -rf .git/modules/lib/shared`, which deletes repository metadata and can permanently remove local state if misapplied. Without a warning, users may run the command on the wrong path or not understand that it affects Git internals rather than just the checked-out files.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill recommends `git stash clear` without warning that it permanently deletes all stashed work, which may include important uncommitted changes not recoverable through normal workflows. In a copy-paste assistant setting, that omission creates a substantial accidental-loss risk.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Undo a bad rebase (find the commit before rebase in reflog)
git reflog
# Find: "ghi789 HEAD@{5}: checkout: moving from feature to main" (pre-rebase)
git reset --hard ghi789

# Recover a deleted branch
git reflog
Confidence
96% confidence
Finding
git reset --hard

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Recover after reset --hard
git reflog
git reset --hard HEAD@{2}   # Go back 2 reflog entries

# Recover a dropped stash
git fsck --unreachable | grep commit
Confidence
96% confidence
Finding
git reset --hard

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.