ClawHub
Back to skill

Security audit

Git Essentials

Security checks across malware telemetry and agentic risk

Overview

The skill appears to provide Git command guidance, including risky cleanup/reset examples, but there is no evidence of hidden automation, exfiltration, persistence, or deceptive behavior.

Install only if you want the agent to provide Git workflow help. Treat reset, clean, rebase, and history-rewrite commands as manual, high-risk operations: run git status and git diff first, prefer dry-run or reversible options, and avoid destructive commands unless you are sure the target repository and changes are disposable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This section includes destructive commands such as `git reset --hard` and commit-rewriting operations that can permanently discard uncommitted work or rewrite history if copied blindly. In a general-purpose skill aimed at broad users, presenting these without immediate, explicit data-loss warnings and safer alternatives increases the chance of accidental destructive use.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The cleanup examples `git clean -f`, `git clean -fd`, and especially `git clean -fdx` delete untracked files and directories, potentially including important local work, build artifacts, or configuration files. Although `git clean -n` is shown, the destructive variants are not accompanied by explicit warnings about irreversible file deletion.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git reset --soft HEAD~1

# Undo last commit (discard changes)
git reset --hard HEAD~1

# Revert commit (create new commit)
git revert commit-hash
Confidence
97% confidence
Finding
git reset --hard

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.