Cross-Branch Migration Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

This is a coherent local repository migration-audit skill with expected git inspection and report generation, but users should handle branch names and search inputs carefully.

Install only if you want an agent to inspect repository history and code for migration planning. Confirm the source branch, target branch, paths, and search terms before running it, and review generated migration advice before performing overwrite or cherry-pick operations. For untrusted repositories or untrusted parameter values, use safe argument handling and avoid shell-string interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:128

Finding

Shell Command Injection Through Unvalidated Audit Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 128–185 and 212–216
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable Code

bash

# Get merge-base of two branches
git merge-base origin/<source-branch> origin/<target-branch>

# Get all commits on source branch for the target module
git log <start-commit>..origin/<source-branch> --oneline --no-merges -- <module-path-1> <module-path-2> ...

# Search using user-provided or expanded terms
git log <start>..<source> --oneline --no-merges --grep="<keyword>"
git log <start>..<source> --oneline --no-merges --grep="<variant1>"
git log <start>..<source> --oneline --no-merges --grep="<variant2>"

# Filter using user-provided author and date values
git log <start>..<source> --oneline --no-merges --author="<author>" --since="<start-date>" --until="<end-date>"

# Search using an issue identifier
git log <start>..<source> --oneline --no-merges --grep="<issue-id>"

# Search paths derived from commits or repository analysis
git log <start>..<source> --oneline --no-merges -- <file1> <file2> ...
git log <start>..<source> --oneline --no-merges -- <referencing-files>

# Iterate over a dynamically constructed commit list
for sha in <commit-list>; do
    all_files=$(git diff-tree --no-commit-id -r --name-only "$sha")
    external_files=$(echo "$all_files" | grep -v "^<module-path-pattern>")
    if [ -n "$external_files" ]; then
        echo "=== $sha ==="
        echo "$external_files"
    fi
done

Technical Analysis

The skill instructs an agent to substitute user-controlled or repository-derived values directly into shell command templates. Relevant inputs include branch names, revisions, module paths, keywords, authors, dates, issue identifiers, file lists, regular-expression patterns, and commit lists.

Several placeholders are unquoted. Values placed inside double quotes also remain vulnerable to shell command substitution, such as $(command) and backticks, if commands ...[truncated 2234 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid shell command construction

   • Invoke Git through an argument-vector process API with shell evaluation disabled.
   • Pass every revision, search term, date, and path as a separate argument.
   • Do not concatenate user input into command strings.

2. Validate revisions and branch names

   • Validate branch names with git check-ref-format --branch.
   • Resolve and validate revisions with git rev-parse --verify.
   • If raw commit IDs are required, enforce the expected hexadecimal length and verify that each object exists and has the required type.
   • Reject control characters, newlines, NUL bytes, and shell metacharacters.

3. Handle collections safely

   • Store commits and paths in arrays rather than space-delimited strings.
   • Iterate over validated array elements.
   • For shell implementations, use forms such as for sha in "${commits[@]}"; never inject a textual list into shell source.

4. Protect path processing

   • Preserve the -- separator before path arguments.
   • Pass each path as an individual argument.
   • Use NUL-delimited Git output where filenames are parsed, such as git diff-tree -z, because repository filenames may contain spaces or newlines.

5. Treat patterns as data

   • Pass --grep, --author, and similar values directly through an argv API.
   • When literal rather than regular-expression matching is intended, escape the value for the target matching engine or use fixed-string matching where supported.
   • Do not rely on double quotes as protection against command substitution in dynamically evaluated shell text.

6. Constrain execution privileges

   • Run audits in a restricted sandbox with minimal filesystem and network access.
   • Avoid exposing unrelated credentials or sensitive environment variables.
   • Use a clean, disposable working tree when processing repositories supplied by untrusted parties.

7. Document secure implementation requirements

...[truncated 332 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 580)May include surrounding context.

md

<head>
    <meta charset="UTF-8">
    <title>Cross-Branch Migration Audit Report</title>
    <!-- Inline CSS: Modern clean design, dark/light mode support -->
    <!-- Inline JS: Filter, search, expand/collapse, export CSV -->
</head>
<body>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 586)May include surrounding context.

md

<body>
    <!-- 0. Critical Risk Alert Panel (pinned top, red/orange background) -->
    <!-- 1. Report header: project name, source branch, target branch, generation time -->
    <!-- 2. Overview statistics cards (commit count, dependency count, risk distribution, estimated workload) -->
    <!-- 3. Commit discovery process (Feature Mode) -->
    <!-- 4. Risk matrix table (filterable, sortable) -->
    <!-- 5. Commit detail list (expandable diff) -->

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares an unusually large set of broad trigger phrases, including generic terms like 'feature audit', 'migration audit', and multilingual variants. This increases the chance of accidental invocation in contexts the user did not intend, which can cause the agent to run extensive repository inspection commands and generate files unexpectedly.

Content

No source excerpt is available for this finding.