T09 · Insecure Skill Coding Practices
Error
- Location
scripts/git_hooks.py:496- Finding
Arbitrary File Deletion Through Unvalidated Hook Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Git Hooks Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Git hook manager, but it needs review because a removal command can delete files outside Git hooks and some templates automatically run package tools.
Review before installing. Use only in repositories where persistent Git hooks are desired, avoid the install-deps template unless you accept automatic package-manager execution after merges, and do not run the remove command with any value other than a normal Git hook name until the path validation issue is fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/git_hooks.py:42- Finding
Unpinned Package Download and Execution Through npx
- Content
View full analysis
/dev/null 2>&1; then echo "$JS_FILES" | xargs npx eslint --fix 2>/dev/null || { echo "ESLint found errors. Fix them before committing." exit 1 } echo "$JS_FILES" | xargs git add fi fi ``` ```sh if [ -n "$WEB_FILES" ] && command -v npx >/dev/null 2>&1; then echo "Running Prettier..." echo "$WEB_FILES" | xargs npx prettier --write 2>/dev/null || true echo "$WEB_FILES" | xargs git add fi ``` ### Technical Analysis The generated hooks verify that `npx` exists but do not verify that `eslint` or `prettier` is installed locally from an audited, locked dependency set. Depending on the installed npm/npx version and configuration, `npx` can resolve an absent command through a package registry, download the package, and execute it. Neither invocation pins a package version, requires offline operation, nor disables remote installation. Consequently, the code executed during a commit may depend on mutable external registry state rather than only on reviewed repository dependencies. ### Attack Path 1. A user installs the `lint-staged` or `format-check` generated hook. 2. The repository does not contain a locally installed `eslint` or `prettier` executable. 3. The user stages a file matching the relevant extension and initiates a commit. 4. The Git hook invokes `npx eslint` or `npx prettier`. 5. `npx` resolves and potentially downloads the package from its configured registry. 6. Downloaded package code executes with the developer account's privileges. Successful malicious exploitation additionally requires compromise or manipulati ...[truncated 547 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/git_hooks.py:355- Finding
Automatic Dependency Installation After Merge Executes Repository-Controlled Code
- Content
View full analysis
/dev/null 2>&1; then pnpm install elif [ -f "yarn.lock" ] && command -v yarn >/dev/null 2>&1; then yarn install elif [ -f "package-lock.json" ]; then npm install fi fi # Python if echo "$CHANGED_FILES" | grep -q "requirements.txt\\|Pipfile.lock\\|poetry.lock"; then echo "Python dependencies changed." if [ -f "Pipfile.lock" ] && command -v pipenv >/dev/null 2>&1; then pipenv install elif [ -f "poetry.lock" ] && command -v poetry >/dev/null 2>&1; then poetry install elif [ -f "requirements.txt" ]; then echo "Run: pip install -r requirements.txt" fi fi ``` ### Technical Analysis The generated `post-merge` hook automatically invokes package managers whenever selected dependency lockfiles change. Package installation can execute lifecycle scripts, build backends, package setup logic, plugins, or other dependency-controlled code. The hook does not request confirmation, inspect the merged dependency changes, disable installation scripts, or enforce immutable/frozen installation behavior. Although the automatic installation behavior is disclosed in `SKILL.md`, it creates a supply-chain execution boundary in which merged repository content causes local code execution as a side effect of a merge or pull. ### Attack Path 1. An attacker submits changes that introduce or modify a dependency and its lockfile. 2. Those changes are accepted into a branch that a developer later merges or pulls. 3. Git invokes ...[truncated 961 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python if [ $FOUND -eq 1 ]; then echo "" echo "Remove debug statements before committing." echo "Use 'git commit --no-verify' to bypass this check." exit 1 fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python if [ $FOUND -eq 1 ]; then echo "" echo "Remove debug statements before committing." echo "Use 'git commit --no-verify' to bypass this check." exit 1 fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python if [ $FOUND -eq 1 ]; then echo "" echo "Remove debug statements before committing." echo "Use 'git commit --no-verify' to bypass this check." exit 1 fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python if [ "$BRANCH" = "$b" ]; then echo "⚠ Direct push to '$BRANCH' is not allowed!" echo "Create a feature branch and open a pull request." echo "Use 'git push --no-verify' to bypass (not recommended)." exit 1 fi done
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises actions that install and remove Git hooks via shell commands and write files into a repository, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent or user to authorize broader execution than intended, increasing the chance of unintended file modification or command execution in a local repo.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The listed templates include behaviors with side effects, such as auto-formatting code and auto-installing dependencies after merge, but the description does not clearly warn users that some templates will modify files or invoke package managers. In an agent setting, that omission can lead to surprising code changes or dependency execution in a repository the user did not expect to be altered.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The post-merge template automatically runs package manager install commands after a merge when lockfiles change. This is risky because merging or pulling untrusted changes can immediately trigger execution paths in package managers, including lifecycle scripts, causing arbitrary code execution from repository-controlled dependency metadata without explicit user confirmation.
- Content