Braingit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:06 AM UTC
• Version: 0.1.2

Overview

The skill is a simple Markdown snapshot helper, but its script can accidentally commit already staged non-Markdown files despite claiming Markdown-only behavior.

Review before installing or automating. Do not run this against repositories with unrelated staged files or sensitive content in the index. Prefer fixing the script to use an isolated Git index or to abort when non-matching files are staged before enabling the cron example.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/commit_md_changes.sh:52

Finding

Pre-Staged Non-Matching Files Are Included in Markdown Snapshot Commits

Content

View full analysis

Vulnerability Details

File Location: scripts/commit_md_changes.sh, lines 52–66
Vulnerability Type: Failure to isolate or validate the Git index
Risk Level: Medium

bash

# Stage only included files
for p in "${CHANGED[@]}"; do
  git add -- "$p" || true
done

# Commit if anything staged
if git diff --cached --quiet; then
  exit 0
fi

git commit -m "$MSG" >/dev/null

Technical Analysis

The script identifies paths matching BRAINGIT_PATTERN and stages those paths, but it does not isolate them from content already present in the Git index. The final git commit -m "$MSG" command commits the entire index, including files staged before the script was invoked.

Consequently, the implementation does not enforce its documented guarantee that only matching Markdown files are committed. The git diff --cached --quiet check also examines the complete index rather than only the selected paths.

Additionally, git add -- "$p" || true suppresses staging failures. This weakens fail-closed behavior because the script can continue and commit unrelated content already in the index even if staging an intended file fails.

Attack Path

1. A non-matching file, such as source code, configuration, or a file containing sensitive data, is staged in the target repository.
2. At least one changed path matching BRAINGIT_PATTERN is present.
3. The script detects the matching path and attempts to stage it.
4. The script checks whether the overall index contains changes.
5. The unrestricted git commit command commits both the selected Markdown path and all files that were previously staged.
6. If the resulting commit is later pushed or otherwise shared, the unintended files and their historical contents can be disclosed.

Impact Assessment

Exploitation does not provide operating-system privilege escalation or access beyond the invoking user's existing repository permissions. Its scope is the targ ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

Isolate the selected paths from the caller's existing Git index before creating the commit. Recommended hardening measures include:

1. Use a temporary Git index through GIT_INDEX_FILE, initialize it from HEAD, stage only approved paths into that index, and commit using that isolated index.
2. Alternatively, inspect the existing index before staging and abort if any staged path falls outside the approved set. This is simpler but prevents operation when the caller has unrelated staged work.
3. Avoid resetting or clearing the caller's index, because doing so could destructively alter unrelated staged work.
4. Remove || true from git add -- "$p" so that staging errors terminate execution under set -e.
5. Validate the isolated staged path list immediately before committing and reject any path that does not match the configured policy.
6. Add automated tests covering pre-staged non-Markdown files, staged deletions, renames, unusual filenames, and staging failures.
7. Update the documentation only after the implementation reliably enforces the stated Markdown-only commit boundary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example sets --tz Europe/Madrid, which imposes a specific locale setting in natural-language documentation. The file does not indicate that this timezone is merely illustrative, region-specific, or user-selectable, so it can be read as prescribing a fixed locale without opt-in.

Content

No source excerpt is available for this finding.