Effective Git

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 1.0.0

Overview

This Git helper is not clearly malicious, but it needs review because it can mutate repositories and some quick-command safety boundaries are under-disclosed.

Install only if you are comfortable letting the skill run Git commands that can change local history and working-tree state. Use explicit commands, review diffs before commits, avoid using untrusted PAGER or GIT_QUICK_DIFF_* environment values, and require clear confirmation before push, amend, reset, clean, rebase, or conflict resolutions that keep only one side.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/git_quick.sh:120

Finding

Unvalidated Environment Variables Permit Execution of Attacker-Controlled Programs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 168)May include surrounding context.

md

### Dangerous Operations

The following operations require user confirmation and risk explanation:
- `git push --force` / `git push -f`
- `git reset --hard`
- `git clean -fd`
- `git rebase` on shared branches

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 305)May include surrounding context.

git rebase origin/main

4. Push and create PR

git push origin HEAD

text

### Hotfix Workflow

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a comprehensive Git assistant covering many operational workflows and special command prefixes. The supplied code chunk instead implements a single-purpose conflict-analysis utility. It reads git repository state, detects unresolved conflicts, extracts conflict markers with context, and prints advice for manual resolution. While conflict analysis is related to Git, the primary purpose is materially narrower than the declared assistant, and key advertised capabilities/triggers are absent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents an intelligent workflow assistant with broad Git support and safety behaviors. The actual code is a straightforward command dispatcher for a subset of Git operations. While some overlap exists—branch listing/creation, status, diff, stash, fetch, and basic commit/amend—the code lacks the key advertised features: automatic change analysis, commit strategy recommendations (amend vs new commit), writing commit messages, project convention adherence, confirmation for dangerous commands, and support for push/rebase/merge. The quick-command style partially aligns conceptually, but the specific declared 'gq' trigger mechanism is not present in this code itself. Therefore the description materially overstates and mischaracterizes the implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a comprehensive Git workflow assistant with command triggers, operational support across many git tasks, automatic analysis, and safety behaviors. The supplied code chunk instead performs one specific function: exporting current working-tree and staged diffs to files in .git/merge-diffs. While this is Git-related and could support merge/rebase workflows, it does not match the declared primary purpose or capabilities. The code also persists data in the .git directory, which is a concrete behavior absent from the description. This is a material description-behavior mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a comprehensive interactive Git assistant with workflow analysis, quick-command triggers, and guidance across many git operations. The supplied code instead is a single-purpose utility for visualizing existing merge conflicts. While merge-related assistance is loosely within the broader Git domain, the primary purpose is materially narrower and different from the declared behavior. It also lacks the described trigger handling and automation features. Therefore, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The skill instructs pushing with 'git push origin HEAD', which forwards whatever commit HEAD references to the remote branch. Even though it says to confirm first, using HEAD directly is a risky parameterization in an agent context because detached HEAD states or unexpected branch contexts can push unintended history to a remote, causing data exposure or integrity issues.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

1. Confirm current branch: `git branch --show-current`
2. Show what will be pushed: `git log origin/$(git branch --show-current)..HEAD --oneline`
3. Ask user to confirm
4. Push: `git push origin HEAD`

Never use `git push --force` without explicit user confirmation.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The skill includes destructive commands like 'git reset --hard' and 'git clean -fd' as supported dangerous operations. In an agent skill, merely normalizing these commands without stronger safeguards can enable irreversible loss of uncommitted work if triggered by ambiguous requests or insufficient confirmation flows.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

These require user confirmation before execution:
- `git push --force` or `git push -f`
- `git reset --hard`
- `git clean -fd`
- `git rebase` on shared/public branches
- `git branch -D` (force delete)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/best-practices.md (reported line 66)May include surrounding context.

md

- Delete merged branches: `git branch -d branch-name`

### Pushing Changes
- Always push to current branch: `git push origin HEAD`
- Never force push to shared branches without team agreement
- Use `git push --force-with-lease` instead of `--force` when needed

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 169)May include surrounding context.

md

### Dangerous Operations
These require extra caution and user confirmation:
- `git push --force` / `git push -f`
- `git reset --hard`
- `git clean -fd`
- `git rebase` on public branches
- `git branch -D` (force delete)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/best-practices.md (reported line 73)May include surrounding context.

md

### Dangerous Operations
These require extra caution and user confirmation:
- `git push --force` / `git push -f`
- `git reset --hard`
- `git clean -fd`
- `git rebase` on public branches
- `git branch -D` (force delete)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/conflict-resolution.md (reported line 377)May include surrounding context.

md

### Dangerous Operations
These require extra caution and user confirmation:
- `git push --force` / `git push -f`
- `git reset --hard`
- `git clean -fd`
- `git rebase` on public branches
- `git branch -D` (force delete)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README labels quick operations as read-only/low-risk, but the documented gq commands include state-changing actions such as branch switching, branch creation/deletion, stashing, and committing. This mismatch can cause an agent or user to trust a mode as safe when it can modify repository state, increasing the chance of unintended destructive actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language activation examples such as "help me commit code" are broad and resemble ordinary conversation, which increases the risk of accidental triggering in contexts where the user did not intend to authorize repository changes. In an agent skill that can commit, push, and rewrite history, ambiguous invocation expands the attack surface for unintended execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The conflict-resolution section first states the assistant must never automatically choose one side, then later lists Keep Ours and Keep Theirs as resolution strategies. That inconsistency can enable silent loss of incoming or local changes if an implementation follows the latter guidance without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The examples for undoing changes include potentially destructive commands like git restore <file> and git reset HEAD~1 without nearby warnings about data loss scenarios, reversibility, or confirmation. In a skill README, examples often get copied directly into workflows, so missing guardrails can lead to accidental loss of uncommitted or unpublished work.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description uses very broad trigger language such as helping with many Git operations and natural-language requests. In agent environments, overbroad trigger conditions can cause unintended invocation and execution of repository-affecting scripts in contexts the user did not clearly intend, increasing the chance of unsafe state changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

At L121 the documentation states 'DO NOT perform automatic merges' during conflict resolution, implying the skill should avoid directly carrying out merge/rebase operations on the user's behalf. However, later sections provide direct execution steps for git rebase and git merge commands, which contradicts that stated safety constraint and creates unclear operational intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The opening principle explicitly states the resolver must present both versions and never automatically choose one side when confidence is lacking. Later sections prescribe default resolutions such as 'Usually keep B's version' and 'Keep B's code' for conflict cases, which contradicts the earlier safety rule and can encourage automatic one-sided resolutions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'Forbidden Actions' section says never automatically choose one side using git checkout --ours or --theirs without explicit user approval. The submodule handling section later presents those exact commands as concrete resolution steps, without reiterating the approval requirement, which contradicts the documented safety intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-command reference exposes state-changing git operations without inline warnings about their effects, reversibility, or prerequisites. In an agent-driven workflow, terse commands like stash pop, branch delete, commit-all, and amend can be executed with little context, increasing the risk of accidental data loss, unintended commits, or history rewriting.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/quick-commands.md (reported line 99)May include surrounding context.

gq "b->" main # Switch to main

text

### Create Feature Branch
```bash
gq b:c        # Confirm current branch
gq b:n feature-x  # Create new branch

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that quick commands are 'read-only or low-risk', but the same reference includes commands that modify repository state, including branch deletion, stash pop, add-all-and-commit, and amend. This mismatch can mislead users or downstream agents into invoking destructive or irreversible actions with reduced scrutiny.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script executes commands taken directly from environment-controlled variables (GIT_QUICK_DIFF_TERMINAL and GIT_QUICK_DIFF_PAGER) without constraining them to trusted binaries. In an agent or automation context, an attacker who can influence the environment can cause arbitrary command execution whenever a user runs a diff command, which goes beyond normal Git workflow behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

git stash pop modifies the working tree and removes the stash entry if successful, which can be difficult to undo and may create conflicts. The script exposes this as a short command but does not provide any confirmation or user-facing warning about the side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.