ClawHub
Back to skill

Security audit

Git Log Tracker (Commit Index & Query CLI)

Security checks across malware telemetry and agentic risk

Overview

The tool is mostly a local commit indexer, but it also includes unrelated agent-behavior policy files and high-impact hook, global Git, and data-reset behavior that should be reviewed before installation.

Install only if you intentionally want persistent local commit logging across selected repositories. Review or remove AGENTS.md/CLAUDE.md if your agent may load them, avoid global mode unless you want future repositories to inherit the hook, treat ~/.commit-logs/index.db as sensitive, and back it up before running reinstall or upgrade cleanup commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly instructs use of shell commands plus file read/write operations against git hooks, SQLite files, and user home-directory config, but it does not declare permissions. That creates a transparency and consent problem: an agent or user may invoke a tool with broader filesystem and command execution effects than expected, including hook installation and data deletion.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The high-level description frames the skill mainly as a commit index/query tool, but the documented behavior also includes recursive repo discovery, batch hook installation, global hook templating for future repos, and destructive reset/reinstall operations. This mismatch can mislead users or agents into granting trust or invoking the skill in situations where they do not expect broad environment changes across many repositories.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file content is unrelated to the declared git-log-tracker skill and instead injects a broad testing/process policy for a different workflow. In an agent skill system, this kind of scope drift is dangerous because it can hijack agent behavior, causing the agent to run unrelated commands, alter commit practices, or ignore the user’s actual intent when the skill is auto-selected.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
Mandating Chinese commit messages without user choice is a policy injection that can override project norms, user preferences, or organizational requirements. In an agent context this is risky because it causes unauthorized behavioral changes in source-control operations and may lead to noncompliant or misleading commits across repositories where this skill is triggered.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README advertises very broad natural-language trigger phrases such as installing hooks, listing commits, and finding commits. In an agentic environment, overly broad triggers can cause the skill to activate on ordinary repository-related requests and perform sensitive actions like hook installation or commit-history indexing without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README emphasizes automatic post-commit capture of metadata into a local SQLite database but does not present a clear, prominent privacy warning about continuous collection. Because commit subjects, author identities, branch names, and repository names may contain sensitive business or personal information, users may enable persistent logging without understanding the scope or duration of data retention.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger text says to use the skill whenever commit logging or related topics are mentioned, even without explicitly naming the tool. Over-broad auto-invocation guidance increases the chance that an agent will select a capability that can alter hooks, scan directories, or modify local data when the user only wanted conceptual help or a read-only query.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented `reinstall` command deletes the data directory and reinitializes state, but the skill text does not present a prominent warning at the point of use about irreversible data loss. In an agent setting, this can lead to accidental destruction of the commit index, labels, and possibly related configuration if invoked during troubleshooting or cleanup.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The upgrade instructions include direct `rm` commands that delete files under `~/.commit-logs/` without an explicit safety warning, backup guidance, or verification step. In an agent-driven onboarding flow, destructive commands in documentation can be executed with little scrutiny, risking accidental data loss or removal of user-modified files.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The reinstall command can delete the entire application data directory or database immediately, without a confirmation prompt or strong warning. In a tool that manages a local SQLite history index, accidental invocation can cause irreversible loss of commit records and configuration, especially because this is an administrative CLI with destructive subcommands.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The hook automatically persists commit metadata, including author identity, email, branch, repo path, subject, and body, into a local SQLite database after every commit. In a post-commit hook context this creates silent collection and retention of potentially sensitive data, and commit bodies may contain secrets or internal information users did not expect to be indexed centrally on disk.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""
    try:
        # Get current branch
        result = subprocess.run(
            ["git", "branch", "--show-current"],
            cwd=repo_path,
            capture_output=True, text=True, timeout=2,
Confidence
88% confidence
Finding
subprocess.run( ["git", "branch", "--show-current"], cwd=repo_path, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
current = result.stdout.strip() or "(detached)"

        # Get all branches
        result = subprocess.run(
            ["git", "branch", "--list"],
            cwd=repo_path,
            capture_output=True, text=True, timeout=2,
Confidence
88% confidence
Finding
subprocess.run( ["git", "branch", "--list"], cwd=repo_path, capture_output

External Script Fetching

Low
Category
Supply Chain
Content
|------|------|----------|
| `git-log-tracker: command not found` | 未安装工具 | `uv tool install D:/modular_dev/kinema_skills/git-log-tracker` |
| `No module named 'tomllib'` | Python < 3.11 | 安装 Python 3.11+ |
| `uv: command not found` | uv 未安装 | `curl -LsSf https://astral.sh/uv/install.sh \| sh` |
| `Hook not triggering` | hook 文件无执行权限 | `chmod +x .git/hooks/post-commit` |
| `database is locked` | 多进程并发写入 | 等待其他操作完成，SQLite 自动处理 |
| `No commits found` | 数据库为空或排除规则过滤了 repo | 检查 `~/.commit-logs/config.toml` 中的 exclude 列表 |
Confidence
97% confidence
Finding
curl -LsSf https://astral.sh/uv/install.sh \| sh

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.