Security checks for vulnerabilities and agentic risk
Overview
This skill gives disclosed Git history-rewrite guidance, but it includes inherently risky force-push and reset commands that users should run only with backups and explicit repository-owner approval.
Install only if you intend to perform Git history rewriting. Before following it, make a verified backup, confirm you own or are authorized to rewrite the remote repository, coordinate with collaborators, prefer narrow branch/tag pushes where possible, and treat any exposed secrets as compromised and rotate them immediately.
### Technical Analysis
The Skill instructs users to install `git-filter-repo` from the package index without specifying a reviewed version, integrity hash, trusted index URL, or signature-verification procedure. Consequently, the package artifact installed when the instructions are followed may differ from the artifact that existed when the Skill was audited.
This creates supply-chain exposure if the upstream package, maintainer account, package index, or dependency resolution process is compromised. A malicious release could execute code during installation or when the installed command is subsequently invoked. The package name itself does not appear to be a typosquat, and the audited Skill contains no evidence that the legitimate package is currently malicious; the finding concerns the unsafe, mutable dependency-installation procedure.
### Attack Path
1. An attacker compromises the package publisher, package distribution channel, or a dependency selected during installation.
2. The attacker publishes a malicious version that still resolves under the unpinned command.
3. A user follows the Skill and runs `pip install git-filter-repo`.
4. The package manager retrieves the attacker-controlled release because no version or artifact hash is enforced.
5. Malicious code executes during installation or when the user later invokes `git filter-repo`.
### Impact Assessment
Successful exploitation could execute arbitrary code with the privileges of the user running `pip`. This could expose repository contents, Git credentials, SSH keys, environment variables, and other files accessible to that account. It could a
...[truncated 294 chars]
Remediation
View remediation
Remediation Suggestions
Pin git-filter-repo to a specifically reviewed version rather than installing the latest available release:
bash
Obtain hashes from a trusted source and review the exact package artifact before documenting it.
Use an explicitly approved package index or an internally controlled artifact mirror instead of relying on mutable default package-index configuration.
Recommend installation in an isolated virtual environment or through a controlled package-management environment with minimal privileges.
Do not run the installation as root or administrator unless strictly necessary.
Establish a process for periodically reviewing and deliberately updating the pinned version and hashes after security validation.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
5. Use git filter-repo to Delete Files
Assuming the file to delete is secrets.txt:
bash
git filter-repo --path secrets.txt --invert-paths
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
5. Use git filter-repo to Delete Files
Assuming the file to delete is secrets.txt:
bash
git filter-repo --path secrets.txt --invert-paths
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
95% confidence
Finding
The skill recommends git push origin --force --all and --force --tags, which are highly destructive operations that can overwrite shared remote history across all branches and tags. In an agent context, providing these commands without strict guardrails, branch scoping, or safer alternatives creates substantial risk of repository corruption, loss of teammates' work, and operational disruption.
Content
Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
bash
# Push all branches
git push origin --force --all
# Push all tags
git push origin --force --tags
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
90% confidence
Finding
git reset --hard origin/main discards local unpushed changes and can cause irreversible loss of work if copied blindly by collaborators. Even though the skill includes a caution comment, the command remains dangerous in a support skill because users may execute it without fully understanding its impact.
Content
Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
Or execute the following command to sync:
bash
git fetch origin
git reset --hard origin/main # Will lose unpushed local changes, use with caution
Warning: Do not continue development based on the old history, otherwise the deleted files will be reintroduced when pushing again
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The activation guidance is broad enough to trigger on many routine Git history-cleanup requests, including destructive rewrite scenarios, without first establishing safety boundaries such as authorization, backup status, or whether a less-destructive alternative would suffice. In an agent setting, this increases the chance the skill is invoked prematurely and steers users toward irreversible repository-wide changes.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill presents git filter-repo and force-push commands before a prominent, upfront warning that history rewriting is irreversible, disrupts collaborators, and can cause permanent data loss. Although some warnings appear later, they are not positioned strongly enough before the dangerous commands, which makes accidental misuse more likely.
