Git Secrets Scanner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Git secret-scanning guide, but it asks users to run persistent hooks or cron jobs, privileged unpinned installs, and destructive Git history rewrites without enough safety guardrails.

Install only if you are comfortable reviewing and tightening the commands first: pin tool and action versions, avoid sudo installs where possible, do not add cron jobs or hooks unless you want ongoing automatic execution, and treat BFG plus git push --force as an incident-response action that needs backups and team coordination.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Note

• Location: SKILL.md:76

Finding

Persistent Git hooks execute scanners across future repository operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76-80 and SKILL.md:170-174
Vulnerability Type: Persistent Git hook installation
Risk Level: Low

Vulnerable Code

bash

# git-secrets
cd your-repo
git secrets --install
git secrets --register-aws

bash

# Add to .git/hooks/pre-commit
#!/bin/bash
gitleaks protect --staged

Technical Analysis

The instructions install a Git pre-commit hook that remains in the repository after the current scanning session and runs during subsequent commits. This persistence directly supports the declared secret-scanning purpose and is transparently documented, so it is not evidence of a hidden backdoor.

Nevertheless, installing a persistent hook exceeds the privileges and duration required for a one-time repository scan. The hook relies on a gitleaks executable resolved through the future user's environment. If that executable, the hook itself, or relevant configuration is later replaced, future commits could trigger unauthorized code under the committing user's account.

Attack Path

1. A user follows the documentation and installs the pre-commit hook.
2. The hook persists in .git/hooks/pre-commit.
3. An attacker with an independent ability to modify the hook, replace the resolved gitleaks executable, or influence its configuration introduces malicious behavior.
4. The user later runs git commit.
5. Git automatically executes the modified component with the user's permissions.

This path requires a separate compromise or modification capability; the supplied instructions do not themselves contain a malicious payload.

Impact Assessment

Exploitation could execute commands with the privileges of the user performing the commit. The practical scope includes files, credentials, repositories, and network access available to that user. The hook does not independently provide root access or cross-repository persistence.

Remediation

View remediation

Remediation Suggestions

• Present hook installation as an explicit, optional alternative to one-time scanning.
• Explain that the hook persists and runs during future commits.
• Provide removal instructions, such as reviewing and deleting the generated .git/hooks/pre-commit file.
• Resolve the scanner through a trusted absolute path rather than relying solely on PATH.
• Pin and verify the scanner version before configuring automatic execution.
• Ensure the generated hook is writable only by the repository owner.
• Prefer centrally reviewed CI enforcement when persistent local hooks are unnecessary.

T06 · System Persistence

Note

• Location: SKILL.md:178

Finding

Weekly cron configuration creates persistent scheduled execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:178-182
Vulnerability Type: Persistent scheduled task
Risk Level: Low

Vulnerable Code

bash

# Weekly scan
crontab -e
0 0 * * 0 cd /path/to/repo && gitleaks detect --source .

Technical Analysis

The documentation recommends adding a weekly cron job. The scheduled scan is consistent with the Skill's defensive purpose, but it persists beyond the current invocation and is not necessary for an on-demand scan.

The command uses a placeholder repository path and resolves gitleaks through the cron environment rather than an immutable absolute path. If the executable, repository path, scanner configuration, or files influencing execution are compromised later, the scheduled task could repeatedly invoke attacker-controlled behavior. Installing this entry in a privileged account would unnecessarily enlarge the potential impact.

Attack Path

1. A user adds the documented command to their crontab.
2. The cron entry persists and executes every week.
3. An attacker with a separate ability to replace the scanner, alter the targeted path, or modify trusted scanner configuration introduces malicious behavior.
4. Cron invokes the compromised component automatically.
5. The payload runs with the permissions of the account that owns the crontab and may run repeatedly until the entry is removed.

The project does not automatically create this task, and exploitation requires the user to install it and a component in its execution chain to be compromised.

Impact Assessment

Successful exploitation could provide recurring command execution with the cron owner's privileges. For a normal user, the scope is that user's accessible files, repositories, credentials, and network resources. If configured in root's crontab, the impact could become system-wide, although the documentation does not instruct users to do so.

Remediation

View remediation

Remediation Suggestions

• Make scheduled scanning explicitly optional and recommend CI or on-demand scanning by default.
• Warn users not to install the job in a privileged account.
• Use absolute, validated paths for both the repository and scanner executable.
• Pin and verify the scanner version used by the task.
• Ensure the repository and scanner configuration are not writable by untrusted users.
• Redirect output to a protected log and configure failure reporting.
• Include removal instructions using crontab -e or crontab -l so users can identify and delete the entry.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Mutable third-party installation references create supply-chain exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-55 and SKILL.md:94-99
Vulnerability Type: Unpinned third-party dependencies and privileged installation
Risk Level: Medium

Vulnerable Code

bash

# Or use Go
go install github.com/gitleaks/gitleaks/v8@latest

bash

# Or use Docker
docker pull trufflesecurity/trufflehog:latest

bash

# Linux
git clone https://github.com/awslabs/git-secrets.git
cd git-secrets
sudo make install

yaml

- uses: actions/checkout@v3
  with:
    fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Technical Analysis

The installation guidance uses mutable references, including Go's @latest, Docker's :latest, an unpinned Git clone, and major-version GitHub Action tags. These references can resolve to different code after the Skill has been reviewed.

The documented sources correspond to recognizable upstream projects, and the audit found no evidence of typo-squatting or a currently malicious dependency. The risk arises because future upstream changes, account compromise, tag movement, or registry compromise could cause users or CI jobs to execute content that was not reviewed with this Skill.

The sudo make install instruction increases potential impact by running an unpinned checkout's installation logic with administrative privileges. The CI action also receives GITHUB_TOKEN, making immutable action pinning particularly important.

Attack Path

1. An upstream repository, release process, container tag, or action tag is compromised or changed maliciously.
2. A user installs through @latest, :latest, or the default Git branch, or a CI job resolves a movable major-version action tag.
3. The package manager, Docker engine, Makefile, or GitHub Actions runner executes the changed content.
4. A malicious installer run through sudo may modify system-wide fi ...[truncated 681 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, explicit Gitleaks version.
• Pin Docker images by immutable digest rather than :latest.
• Check out a specific signed release tag or commit instead of cloning and installing the default branch.
• Verify release checksums or signatures before installation.
• Avoid sudo make install; install into a user-controlled directory where practical.
• Pin GitHub Actions to full immutable commit SHAs and document the corresponding release versions.
• Set explicit minimal workflow permissions, such as read-only repository access unless additional rights are required.
• Review upstream release notes and provenance before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

### 其他
- 私钥
- 证书
- .env 文件

## 输出示例

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This duplicate finding points to the same force-push instruction, which is dangerous because it can rewrite shared history and cause repository inconsistency or loss of teammates' commits if used hastily. The incident-response context explains why it appears, but it still needs stronger safety framing and safer command guidance.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`（谨慎使用）
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This duplicate finding points to the same force-push instruction, which is dangerous because it can rewrite shared history and cause repository inconsistency or loss of teammates' commits if used hastily. The incident-response context explains why it appears, but it still needs stronger safety framing and safer command guidance.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md

1. **立即撤销** - 重新生成 API key
2. **删除历史** - 从 git 历史中删除敏感信息
3. **强制推送** - `git push --force`(谨慎使用)
4. **通知团队** - 告知其他开发者

### 使用 BFG 清理历史

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Linux

git clone https://github.com/awslabs/git-secrets.git cd git-secrets sudo make install

text

## 使用方法

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

bash

# 每周扫描
crontab -e
0 0 * * 0 cd /path/to/repo && gitleaks detect --source .

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The history-rewrite and force-push guidance can cause irreversible repository disruption, data loss for collaborators, and operational mistakes if copied without strong warnings and safer prerequisites. In a security-remediation skill this context makes the action understandable, but the instructions still need clearer upfront cautions because users may execute them quickly during incident response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language description and instructions are presented entirely in Chinese, which effectively forces a specific language for users without any opt-in or indication that the skill is intended only for a Chinese-speaking audience. Under the policy, language constraints should be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written entirely in Chinese, which can impose a language-specific experience without any visible user opt-in or justification. The policy requires either a language choice or a clearly documented reason for a locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.