ClawHub
Back to skill

Security audit

AtomGit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AtomGit helper that relies on a user-managed MCP server and token, with reasonable safety guidance for destructive or broad changes.

Install only if you intend to use AtomGit through the AtomGit MCP server. Configure ATOMGIT_TOKEN outside chat, start with the smallest token scope that supports the task, and require explicit confirmation before write, destructive, organization, enterprise, webhook, runner, or account-profile changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-and-safety.md (reported line 20)May include surrounding context.

md
<https://atomgit.com/zkxw2008/AtomGit-MCP-Server>
- AtomGit MCP Server npm package:
  <https://www.npmjs.com/package/@atomgit.com/atomgit-mcp-server>
- Personal access token:
  `ATOMGIT_TOKEN`

Review the upstream repository or package page before installing the MCP server. This skill assumes the server has already been installed and verified outside the task runtime.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The primary descriptive content in the README is written in Chinese, with no indication that users or agents may choose another language. This creates a language/locale policy concern because it implicitly requires a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- `branch`, `tag`, `path`, or `sha` when the workflow needs them
7. Confirm destructive or org-wide changes before executing them.

AtomGit MCP must be installed and configured outside this skill before the first AtomGit task. Do not wait until after a business request fails if the tool list already shows the server is missing, and do not ask users to paste tokens into chat.

## Tool Naming

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file documents actions such as inviting enterprise members, updating member permissions, and creating or updating enterprise milestones. Because the file describes operations that can change enterprise access or state, it should include an explicit warning about potential impact and the need for user confirmation, but no such warning appears in the file.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/setup-and-safety.md (reported line 62)May include surrounding context.

md
- Prefer discovery calls before mutation calls.
- Confirm destructive, irreversible, or broad-scope changes with the user before executing them.
- Use a dedicated high-privilege token for org or enterprise administration instead of reusing a general token.
- If the server exposes dangerous operations behind `ATOMGIT_ENABLE_DANGEROUS_TOOLS=true`, treat that as an extra gate, not as permission to skip confirmation.
- The runtime-exposed tool set depends on `ATOMGIT_ENABLE_DANGEROUS_TOOLS`; docs may describe more tools than the current session actually exposes.
- If the MCP server is missing, pause the task and ask the operator to install or connect it manually after reviewing the upstream source.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly directs use of tools that expose sensitive user data such as profile details, emails, SSH keys, subscriptions, and repository views, but provides no warning, consent guidance, or data-minimization constraints. In an agent skill, this increases the chance that the agent will retrieve or expose private account data more broadly than the user intended, especially when handling ambiguous requests involving 'me' or other users.

Content

No source excerpt is available for this finding.