Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A merge or rebase stopped on conflicts | `conflicts.md` |
Security audit
Git
Security checks for vulnerabilities and agentic risk
Overview
This Git helper skill contains expected repository-management guidance and scoped local preference memory, with no hidden execution or data exfiltration found.
Install this only if you want an agent to help with Git operations, including commits, rebases, force-push safety, hooks, and recovery. Review or disable the ~/Clawic/data/git/ preference memory if you do not want repo names, workflow preferences, or safety preferences retained locally across sessions, and confirm before allowing destructive Git commands or global git config changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (45)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A merge or rebase stopped on conflicts | `conflicts.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Wrong author identity, auth failures, ignore rules, CRLF churn | `config.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Wrong author identity, auth failures, ignore rules, CRLF churn | `config.md` |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md |------|--------------|------------| | `git stash` before a risky operation, expecting untracked files saved | Plain stash skips untracked files | `git stash -u` | | Assuming `stash pop` dropped the stash after a conflict | Pop only drops on clean apply; on conflict the entry stays | Resolve, then `git stash drop` | | `git clean -fdx` to "clean build artifacts" | `-x` also deletes ignored files: `.env`, IDE config, local secrets | `git clean -fd`, always preview with `-n` | | Renaming `Foo.js` → `foo.js` works locally, breaks CI | macOS/Windows filesystems are case-insensitive, Linux is not | `git mv Foo.js tmp && git mv tmp foo.js` | | `git branch -d` refuses to delete after squash-merge | Squashed commits are unreachable from main, so Git thinks the branch is unmerged | Verify the PR merged, then `-D` | | Committing a large binary "just this once" | GitHub warns >50 MB, blocks >100 MB — and history keeps the blob forever | Git LFS before first commit; after the fact, `git filter-repo` (`secrets.md`) |
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - A new branch inherits your CURRENT commit — `git switch -c feature main` pins the base explicitly; branching from a stale or wrong branch bakes the wrong history into every commit that follows. - `git branch feature` creates without switching — your next commits land on the old branch. Prefer `git switch -c feature`. - `git switch`/`git restore` (git >=2.23) split what `git checkout` overloaded: switching branches versus restoring files. The classic `git checkout <path>` that destroys working-tree changes with no warning is why the split exists. - Switching with uncommitted changes is inconsistent by design: Git carries changes over when no files overlap, blocks when they do. That "sometimes it works" is why `rebase.autostash` and explicit `git stash` exist. Untracked files always travel with you. - Branch and tag sharing a name: in revision arguments Git resolves the TAG first (with an "ambiguous refname" warning) — a checkout you think targets the branch may target the tag. Rename one. - `feature/x` creates directory `refs/heads/feature/` — after that, a branch named plain `feature` cannot exist ("cannot lock ref"). Pick flat or hierarchical naming, not both.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Force Push - `--force-with-lease` only protects against remote states you have not seen — and IDE auto-fetch updates refs without warning, voiding the lease. `--force-if-includes` (git >=2.30) additionally requires the remote commits to be integrated in your local history. Both flags, always (SKILL.md, rule 2). - Force-pushing during review invalidates line comments and the reviewed state. Push `--fixup` commits while review is open; autosquash after approval, before merge. - Before any force push, look at what you are about to erase: `git log @{u}..` (yours) and `git log ..@{u}` (theirs). A non-empty second list means someone else's work is in the blast radius. - Branch protection on main (require PR, block force push) is infrastructure, not etiquette — configure it before the first incident, not after.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Force Push - `--force-with-lease` only protects against remote states you have not seen — and IDE auto-fetch updates refs without warning, voiding the lease. `--force-if-includes` (git >=2.30) additionally requires the remote commits to be integrated in your local history. Both flags, always (SKILL.md, rule 2). - Force-pushing during review invalidates line comments and the reviewed state. Push `--fixup` commits while review is open; autosquash after approval, before merge. - Before any force push, look at what you are about to erase: `git log @{u}..` (yours) and `git log ..@{u}` (theirs). A non-empty second list means someone else's work is in the blast radius. - Branch protection on main (require PR, block force push) is infrastructure, not etiquette — configure it before the first incident, not after.
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md git config --global rebase.missingCommitsCheck error # refuse a rebase todo list that drops commits without warning
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Push/Pull Precision
bash git push origin HEAD # push current branch without typing its name git push --force-with-lease --force-if-includes # git >=2.30: refuses even if auto-fetch already saw the remote move git push origin HEAD:main # push current branch to a differently named remote branch git push --follow-tags # send annotated tags reachable from what you're pushing
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash git config --global gpg.format ssh # git >=2.34 git config --global user.signingkey ~/.ssh/id_ed25519.pub git config --global commit.gpgsign true git config --global tag.gpgsign true
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Refuses To Start **`fatal: Unable to create '.../.git/index.lock': File exists`** Another Git process holds the index, or one crashed. Check for a live process (an IDE fetching, a hook, a paused rebase) before deleting anything. Only when nothing is running: `rm -f .git/index.lock`. Deleting the lock under a live process corrupts the index. **`fatal: not a git repository (or any of the parent directories)`** Wrong directory, or the `.git` file of a linked worktree points at a main repo that moved (`worktrees.md`). `git rev-parse --show-toplevel` confirms where Git thinks it is.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md `git pull` with no strategy configured. `git >=2.27` warns and newer versions refuse outright. Set it once: `git config --global pull.rebase true` (`commands.md`). **`fatal: refusing to merge unrelated histories`** The two branches have different root commits — a `git init` that later got a remote added, a shallow clone, or an accidental second repo. `--allow-unrelated-histories` is correct only when you actually intend to graft two projects together (`remotes.md`); otherwise you are merging the wrong thing. **`error: cannot pull with rebase: You have unstaged changes`** `git pull --rebase --autostash`, or set `rebase.autostash true` permanently.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md `git pull` with no strategy configured. `git >=2.27` warns and newer versions refuse outright. Set it once: `git config --global pull.rebase true` (`commands.md`). **`fatal: refusing to merge unrelated histories`** The two branches have different root commits — a `git init` that later got a remote added, a shallow clone, or an accidental second repo. `--allow-unrelated-histories` is correct only when you actually intend to graft two projects together (`remotes.md`); otherwise you are merging the wrong thing. **`error: cannot pull with rebase: You have unstaged changes`** `git pull --rebase --autostash`, or set `rebase.autostash true` permanently.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Discard working-tree edits to one path | `git restore <path>` | Irrecoverable if never staged (SKILL.md rule 4) | | Fix the last commit message | `git commit --amend` | A new SHA — unpushed only | | Drop a file from the last commit | `git restore --source HEAD~1 --staged --worktree <path> && git commit --amend --no-edit` | A new SHA | | Move the last 3 commits to a new branch | `git branch feature && git reset --hard HEAD~3` | The commits live on `feature` | | Delete a commit from the middle (unpushed) | `git rebase -i <sha>~1`, mark `drop` | New SHAs from that point on | | Undo anything already pushed | `git revert <sha>` | A new commit; history intact | | Anything else | `git reflog` first, then the smallest tool that reaches the goal (SKILL.md rule 8) | — |
Static analysis
No suspicious patterns detected.