Permanently Clear Files from Git History

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:50 AM UTC
• Version: 1.0.0

Overview

This skill gives disclosed Git history-rewrite guidance, but it includes inherently risky force-push and reset commands that users should run only with backups and explicit repository-owner approval.

Install only if you intend to perform Git history rewriting. Before following it, make a verified backup, confirm you own or are authorized to rewrite the remote repository, coordinate with collaborators, prefer narrow branch/tag pushes where possible, and treat any exposed secrets as compromised and rotate them immediately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 53-61 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash **Ubuntu / Debian:** ```bash pip install git-filter-repo ``` **Windows:** ```bash pip install git-filter-repo ``` ``` ### Technical Analysis The Skill instructs users to install `git-filter-repo` from the package index without specifying a reviewed version, integrity hash, trusted index URL, or signature-verification procedure. Consequently, the package artifact installed when the instructions are followed may differ from the artifact that existed when the Skill was audited. This creates supply-chain exposure if the upstream package, maintainer account, package index, or dependency resolution process is compromised. A malicious release could execute code during installation or when the installed command is subsequently invoked. The package name itself does not appear to be a typosquat, and the audited Skill contains no evidence that the legitimate package is currently malicious; the finding concerns the unsafe, mutable dependency-installation procedure. ### Attack Path 1. An attacker compromises the package publisher, package distribution channel, or a dependency selected during installation. 2. The attacker publishes a malicious version that still resolves under the unpinned command. 3. A user follows the Skill and runs `pip install git-filter-repo`. 4. The package manager retrieves the attacker-controlled release because no version or artifact hash is enforced. 5. Malicious code executes during installation or when the user later invokes `git filter-repo`. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `pip`. This could expose repository contents, Git credentials, SSH keys, environment variables, and other files accessible to that account. It could a ...[truncated 294 chars]
• Remediation: ## Remediation Suggestions 1. Pin `git-filter-repo` to a specifically reviewed version rather than installing the latest available release: ```bash python -m pip install "git-filter-repo==REVIEWED_VERSION" ``` 2. Require hash verification using a locked requirements file: ```text git-filter-repo==REVIEWED_VERSION \ --hash=sha256:VERIFIED_ARTIFACT_HASH ``` Then install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Obtain hashes from a trusted source and review the exact package artifact before documenting it. 4. Use an explicitly approved package index or an internally controlled artifact mirror instead of relying on mutable default package-index configuration. 5. Recommend installation in an isolated virtual environment or through a controlled package-management environment with minimal privileges. 6. Do not run the installation as root or administrator unless strictly necessary. 7. Establish a process for periodically reviewing and deliberately updating the pinned version and hashes after security validation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

### 5. Use git filter-repo to Delete Files

Assuming the file to delete is `secrets.txt`:

```bash
git filter-repo --path secrets.txt --invert-paths

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### 5. Use git filter-repo to Delete Files

Assuming the file to delete is `secrets.txt`:

```bash
git filter-repo --path secrets.txt --invert-paths

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Push all branches
git push origin --force --all

# Push all tags
git push origin --force --tags

• Confidence: 95% confidence
• Finding: The skill recommends `git push origin --force --all` and `--force --tags`, which are highly destructive operations that can overwrite shared remote history across all branches and tags. In an agent context, providing these commands without strict guardrails, branch scoping, or safer alternatives creates substantial risk of repository corruption, loss of teammates' work, and operational disruption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **Or execute the following command to sync:**
   ```bash
   git fetch origin
   git reset --hard origin/main  # Will lose unpushed local changes, use with caution
   ```

3. **Warning:** Do not continue development based on the old history, otherwise the deleted files will be reintroduced when pushing again

• Confidence: 90% confidence
• Finding: `git reset --hard origin/main` discards local unpushed changes and can cause irreversible loss of work if copied blindly by collaborators. Even though the skill includes a caution comment, the command remains dangerous in a support skill because users may execute it without fully understanding its impact.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance is broad enough to trigger on many routine Git history-cleanup requests, including destructive rewrite scenarios, without first establishing safety boundaries such as authorization, backup status, or whether a less-destructive alternative would suffice. In an agent setting, this increases the chance the skill is invoked prematurely and steers users toward irreversible repository-wide changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill presents `git filter-repo` and force-push commands before a prominent, upfront warning that history rewriting is irreversible, disrupts collaborators, and can cause permanent data loss. Although some warnings appear later, they are not positioned strongly enough before the dangerous commands, which makes accidental misuse more likely.

Static analysis

No suspicious patterns detected.