ClawHub
Back to skill

Security audit

Git Stats

Security checks for vulnerabilities and agentic risk

Overview

This git statistics skill does what it says, but users should review it because it exposes contributor emails and its line-counting code can read through tracked symlinks outside the repository boundary.

Install only if you are comfortable with the skill reading tracked repository files and showing contributor names and emails from git history. Avoid running it on untrusted repositories unless LOC counting is skipped or the symlink handling is fixed, and treat JSON/text output as potentially containing personal or internal contact information.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/git_stats.py:102
Finding

Tracked Symbolic Links Can Cause Out-of-Repository File Reads

Content
View full analysis
Remediation
View remediation
` or an equivalent plumbing command. This counts the versioned object rather than following working-tree links and better matches the stated purpose of analyzing tracked repository content. 5. Add regression tests covering: - A tracked symlink to a file outside the repository. - A tracked symlink to a directory outside the repository. - Nested paths that resolve outside the repository. - Ordinary tracked files that remain within the repository. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes local code and shell-accessed functionality (python3 scripts/git_stats.py, git) but does not declare any tool scope such as permissions or allowed-tools. That creates ambiguity about what the skill is permitted to access and increases the chance an agent could run it with broader-than-necessary file read or shell privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description uses broad activation phrases such as analyzing repos, showing git stats, contributor info, and counting lines of code, which can match many common user requests. Over-broad triggering can cause the skill to activate unexpectedly and perform shell/file operations in contexts where the user did not clearly intend repository analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented output explicitly includes contributor rankings with email addresses from git history, but there is no warning that this may expose personal or sensitive information. In shared environments, logs, screenshots, or downstream JSON processing, the skill could disclose contributor email addresses without the user's awareness.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_stats.py (reported line 21)May include surrounding context.

python
def run_git(args, cwd=None):
    """Run a git command and return stdout lines."""
    try:
        result = subprocess.run(
            ["git"] + args,
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The tool enumerates contributor names and email addresses and prints them by default in both text and JSON output, which can expose personal or internal contact information from repository history. In the skill context, this is more dangerous because repository analytics are likely to be shared, pasted into chats, or run against private enterprise repositories where author emails may be sensitive.

Content

No source excerpt is available for this finding.