每天工作结束后，一键生成当日所有 Git 仓库的提交日报，支持多仓库扫描

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

GitPulse is a disclosed local Git commit report skill that reads repository metadata but does not write files, persist, or send data out.

Install only if you are comfortable with the agent scanning Git repositories under the current or specified root and showing commit metadata to the assistant. Use an explicit narrow --root path when possible, and avoid running it from a directory containing unrelated or confidential repositories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill is presented entirely in Chinese and the invocation examples are Chinese-only, with no indication that users may choose another language or locale. This can violate language-choice policy when a skill implicitly requires a specific language without opt-in.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases include broad everyday language such as '今天写了什么', which can cause accidental invocation during normal conversation rather than an intentional request to scan repositories. In this skill, accidental activation is meaningful because the described behavior enumerates local Git repositories and reads commit metadata, creating unintended privacy exposure and surprise execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes a Python script via shell-like execution but does not declare any tool scope or permissions boundary. This makes execution authority implicit, reducing reviewability and increasing the chance that an agent runs local commands against the filesystem without explicit user or platform consent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad and include common conversational requests like '今天写了什么' and '提交记录', which can cause the skill to auto-activate unintentionally. Because activation leads to local multi-repository scanning and commit enumeration, accidental invocation can expose metadata from unrelated repositories without the user realizing a scan will occur.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description does not warn users that it will recursively scan multiple repositories from a default or user-specified root and enumerate commit metadata including author, timestamps, hashes, and messages. In a local assistant context, this can reveal sensitive project names, internal activity patterns, and commit contents/metadata across unrelated workspaces, making the behavior more dangerous than a single-repo summary tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""读取当前仓库（或全局）git config user.name"""
    for scope in (["-C", repo_path], ["--global"]):
        try:
            r = subprocess.run(
                ["git"] + scope + ["config", "user.name"],
                capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=5,
            )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.append(f"--author={author}")

    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README advertises automatic scanning of all Git repositories and commit history but does not clearly warn that repository names, commit messages, author names, timestamps, and paths may be privacy-sensitive. That omission increases the chance users run the skill without realizing it will access and summarize local development metadata, which may include confidential project information.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The workflow explicitly says “生成中文日报”, which forces Chinese as the output language. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; this file does neither.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The comment explicitly says stdout is 'forced' to use UTF-8, and the code implements that behavior unconditionally for non-UTF-8 consoles. This imposes a specific encoding/locale behavior without offering user opt-in or configuration.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script enumerates repositories under a user-selected root and prints commit hashes, author names, timestamps, and commit messages without any privacy notice, consent step, or redaction option. In an agent-skill context, this can expose sensitive internal project names, work patterns, or confidential commit contents to logs, downstream tools, or an LLM consuming the output.

Static analysis

No suspicious patterns detected.