ClawHub
Back to skill

Security audit

Git Deployer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Git deployment helper, but it can overwrite remote branches and has unsafe checkout/copy behavior that could expose credentials or run unexpected local Git hooks.

Review before installing. Use this only with a dedicated deployment repository and least-privileged credentials, avoid credential-bearing HTTPS URLs, do not point it at untrusted site directories, and avoid shared branches unless you are comfortable with an unconditional forced overwrite. A safer version would use a private fresh checkout, exclude .git, validate the remote and branch, redact logged URLs, and require explicit confirmation for destructive pushes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy.sh:24
Finding

Predictable and Unvalidated Temporary Checkout Enables Local Code Execution and Repository Redirection

Content
View full analysis
/dev/null || git checkout -b "$BRANCH" fi ``` Subsequent commands also operate on the trusted checkout: ```bash git commit -m "$COMMIT_MSG" COMMIT_HASH=$(git rev-parse HEAD) git push -u origin "$BRANCH" --force ``` ### Technical Analysis The checkout location is deterministically derived from the basename of the user-provided remote URL and placed directly under the shared `/tmp` directory. The script treats any existing directory at that location as a valid checkout without checking: - Its owner and permissions. - Whether the path or any parent component is a symbolic link. - Whether it is a valid Git repository created by this script. - Whether its configured `origin` matches the supplied `REMOTE_URL`. - Whether it contains attacker-controlled Git hooks or configuration. Git commands can invoke repository-local hooks. For example, checkout operations can invoke `post-checkout`, pull operations can invoke merge-related hooks, and commits can invoke `pre-commit` or other commit hooks. An attacker-prepared ...[truncated 1960 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy.sh:46
Finding

Unrestricted Synchronization Can Delete or Replace Git Control Metadata

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` - Consider synchronizing content into a separate staging directory first, validating it, and then copying only approved static artifacts into the checkout. - After copying, verify that `$TMP_CLONE/.git` remains the expected repository metadata and that its origin still matches the requested remote. - Disable repository-local hooks for all Git commands by setting a trusted empty `core.hooksPath`. - Run the deployment under a dedicated least-privileged account without access to unrelated credentials or repositories. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/deploy.sh:31
Finding

Authenticated Remote URLs Are Disclosed in Deployment Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Force-pushing overwrites remote branch history and can permanently discard commits on the destination branch if the local clone is stale, incorrect, or pointed at the wrong repository. In this skill, the risk is elevated because the tool accepts arbitrary remote and branch parameters and performs the destructive push non-interactively.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

This command combines user-controlled branch selection with an unconditional forced update to origin, enabling parameter-driven destructive actions against arbitrary repositories configured by the caller. Because the script is designed for deployment and runs without approval checkpoints, misuse or operator error can overwrite the remote branch contents and history.

Content

Scanner excerpt · scripts/deploy.sh (reported line 73)May include surrounding context.

sh
# Force push
echo "[5/5] Force-pushing to $BRANCH..."
git push -u origin "$BRANCH" --force

echo ""
echo "=== Deploy Complete ==="

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script mirrors the source directory into the clone using rsync with --delete, which will remove any files in the target clone that are not present in the local site directory. In a deployment tool this may be intentional, but without an explicit safeguard, dry-run, or warning it can silently destroy checked-in assets or branch contents before they are committed and pushed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.