Git

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.5

Overview

This skill is a small Git clone/update helper, but its update path can pull from a different existing repository origin than the URL the user supplied.

Install only if you are comfortable with the skill modifying the target Git working tree. Before using it on an existing directory, verify that the directory is the intended repository and that its origin remote matches the URL you expect.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/git_clone_or_update.sh:23

Finding

Existing Repository Origin Is Not Validated Against the Requested Remote URL

Content

View full analysis

Vulnerability Details

File Location: scripts/git_clone_or_update.sh, lines 23-29
Vulnerability Type: Repository origin confusion and unsafe update behavior
Risk Level: Medium

bash

if [ -d "${GIT_LOCAL_PATH}" ]; then
    # Directory exists — fetch and pull latest changes
    cd "${GIT_LOCAL_PATH}" || {
        echo "ERROR: Failed to enter directory ${GIT_LOCAL_PATH}. Check: $0"
        exit 1
    }
    git fetch origin "${GIT_BRANCH}"
    git pull origin "${GIT_BRANCH}"

Technical Analysis

When GIT_LOCAL_PATH already exists, the script changes into that directory and fetches from its configured origin. It does not:

• Confirm that the directory is a valid Git working tree.
• Compare git remote get-url origin with the supplied GIT_REMOTE_URL.
• Use the supplied GIT_REMOTE_URL during the update.
• Require a fast-forward-only update.

Consequently, the required GIT_REMOTE_URL input is effectively ignored for existing directories. The update source is instead determined by mutable configuration inside the selected local repository. This creates a repository-origin confusion vulnerability: a caller may believe that content is being updated from a trusted URL while the script actually retrieves it from a different or attacker-controlled origin.

Attack Path

1. An attacker prepares or influences an existing directory at the path later supplied through GIT_LOCAL_PATH.
2. The directory is configured as a Git repository with origin pointing to an attacker-controlled repository.
3. A caller invokes the skill with that local path and supplies an expected trusted repository through GIT_REMOTE_URL.
4. Because the local directory already exists, the script ignores the supplied URL.
5. git fetch origin and git pull origin retrieve and integrate content from the attacker-controlled origin.
6. The attacker can alter files in the working tree. If the existing local reposit ...[truncated 794 chars]

Remediation

View remediation

Remediation Suggestions

• Verify that an existing target is a valid Git working tree before updating it, for example with git rev-parse --is-inside-work-tree.
• Read the configured origin using git remote get-url origin and compare its canonicalized value with GIT_REMOTE_URL.
• Reject origin mismatches by default. If changing the origin is supported, require explicit caller confirmation before using git remote set-url origin.
• Validate GIT_BRANCH as a permitted Git branch or ref name and reject option-like or malformed input.
• Use a fast-forward-only update, such as git pull --ff-only origin "${GIT_BRANCH}", to prevent unexpected merge commits.
• Consider fetching first and explicitly checking the intended commit or ref before modifying the working tree.
• Produce a clear error when an existing path is not a Git repository or does not have the expected remote.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

## Important Principles ⭐

**Modification Prohibited (Mandatory)**: Any files under `skill-git-scm`. This skill is maintained via
`openclaw skills update skill-git-scm`; any alterations will disrupt its normal operation.

## git:interface-01 - Clone or Update