Security audit
Security checks for vulnerabilities and agentic risk
GitPulse is a disclosed local Git commit report skill that reads repository metadata but does not write files, persist, or send data out.
Install only if you are comfortable with the agent scanning Git repositories under the current or specified root and showing commit metadata to the assistant. Use an explicit narrow --root path when possible, and avoid running it from a directory containing unrelated or confidential repositories.
The skill is presented entirely in Chinese and the invocation examples are Chinese-only, with no indication that users may choose another language or locale. This can violate language-choice policy when a skill implicitly requires a specific language without opt-in.
The trigger phrases include broad everyday language such as '今天写了什么', which can cause accidental invocation during normal conversation rather than an intentional request to scan repositories. In this skill, accidental activation is meaningful because the described behavior enumerates local Git repositories and reads commit metadata, creating unintended privacy exposure and surprise execution.
The skill invokes a Python script via shell-like execution but does not declare any tool scope or permissions boundary. This makes execution authority implicit, reducing reviewability and increasing the chance that an agent runs local commands against the filesystem without explicit user or platform consent.
The trigger phrases are broad and include common conversational requests like '今天写了什么' and '提交记录', which can cause the skill to auto-activate unintentionally. Because activation leads to local multi-repository scanning and commit enumeration, accidental invocation can expose metadata from unrelated repositories without the user realizing a scan will occur.
The skill description does not warn users that it will recursively scan multiple repositories from a default or user-specified root and enumerate commit metadata including author, timestamps, hashes, and messages. In a local assistant context, this can reveal sensitive project names, internal activity patterns, and commit contents/metadata across unrelated workspaces, making the behavior more dangerous than a single-repo summary tool.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""读取当前仓库（或全局）git config user.name"""
for scope in (["-C", repo_path], ["--global"]):
try:
r = subprocess.run(
["git"] + scope + ["config", "user.name"],
capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=5,
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.append(f"--author={author}")
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
The README advertises automatic scanning of all Git repositories and commit history but does not clearly warn that repository names, commit messages, author names, timestamps, and paths may be privacy-sensitive. That omission increases the chance users run the skill without realizing it will access and summarize local development metadata, which may include confidential project information.
The workflow explicitly says “生成中文日报”, which forces Chinese as the output language. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; this file does neither.
The comment explicitly says stdout is 'forced' to use UTF-8, and the code implements that behavior unconditionally for non-UTF-8 consoles. This imposes a specific encoding/locale behavior without offering user opt-in or configuration.
The script enumerates repositories under a user-selected root and prints commit hashes, author names, timestamps, and commit messages without any privacy notice, consent step, or redaction option. In an agent-skill context, this can expose sensitive internal project names, work patterns, or confidential commit contents to logs, downstream tools, or an LLM consuming the output.