T09 · Insecure Skill Coding Practices
- Location
SKILL.md:43- Finding
Repository-Wide Rollback Can Destroy Unrelated Local Changes
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 43–49
Vulnerability Type: Unsafe repository-wide rollback
Risk Level: HighVulnerable Code Snippet:
markdown - Else if update and test attempts are 3 or more, then: - Undo failing updates, and add the corresponding `TODO` items back to the **Current** `TODO.md` section as incomplete, then: - Note completed `TODO` items and resolve to `CHANGELOG.md Updating` section of this skill - Resolve to `Closing` section of this skill as either: - Updates **partially applied**, and: - Revert relevant files according to failing and passing updates - Updates **not applied**, and: - Restore all relevant files, so essentially: - In the terminal run: `git restore .`Technical Analysis
The Skill instructs the Agent to execute
git restore .when updates cannot be applied successfully. This command restores all tracked files within the current repository working tree from the Git index. It is not restricted to files modified by the Skill and is not preceded by a check for pre-existing local changes.Consequently, the rollback procedure cannot distinguish the Skill's changes from unrelated unstaged work created by the user or another process. Although the stated purpose is to restore files affected by the failed update, the command has repository-wide scope and violates least-change principles.
The issue does not require command injection or elevated operating-system privileges. It arises directly from following the documented failure-handling workflow in a repository containing unrelated unstaged modifications.
Attack Path
- A user invokes the Skill in a Git repository that already contains unrelated unstaged changes to tracked files.
- The Skill processes items from
TODO.mdand modifies repository files. - The resulting update fa ...[truncated 1168 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the repository-wide rollback with a transaction-like, file-scoped recovery procedure:
- Before making changes, detect and report pre-existing modifications using
git status --porcelain. - Record the exact files the Skill intends to modify.
- Preserve each target file's original content, or create a temporary patch containing only the Skill's changes.
- On failure, restore only files and hunks changed by the Skill rather than the entire working tree.
- Prefer performing automation in an isolated Git worktree or temporary branch.
- If a broad rollback is unavoidable, require explicit user confirmation after displaying the exact files and changes that would be discarded.
- Never run
git restore .automatically when pre-existing unstaged changes are present.
A safer instruction would require targeted paths, such as restoring an explicit allowlist of files after verifying that those files had no pre-existing user changes. For mixed files, restore only the Skill-generated hunks from a captured reverse patch.
- Before making changes, detect and report pre-existing modifications using