T09 · Insecure Skill Coding Practices
Error
- Location
scripts/github-contribution.sh:46- Finding
Destructive Repository Reset Without Adequate State Validation
- Content
View full analysis
/dev/null; then echo "🔗 添加官方仓库作为 upstream 远程" git remote add upstream "https://github.com/${OWNER_REPO}.git" else echo "🔗 Upstream 远程已存在" fi # 5. 确保在 main/master 分支并同步到最新 echo "🔄 同步你的 Fork 到官方最新状态" git checkout main 2>/dev/null || git checkout master git fetch upstream git reset --hard upstream/main 2>/dev/null || git reset --hard upstream/master ``` The related synchronization example in `SKILL.md`, lines 223-228, is even more destructive: ```bash git checkout main git fetch upstream git reset --hard upstream/main git clean -fdx # Remove all untracked files ``` ### Technical Analysis When the target directory already exists, the script reuses it without checking whether it contains: - Modified or staged tracked files - Untracked work - Ignored local configuration - Unpushed commits - An interrupted merge or rebase - Work that belongs to another repository or worktree The script then checks out the default branch and executes `git reset --hard`, which overwrites the index and working tree to match the fetched upstream branch. The documented `git clean -fdx` command additionally delete ...[truncated 1963 chars]- Remediation
View remediation
/dev/null 2>&1 || { echo "Target directory is not a Git repository." exit 1 } if [[ -n "$(git status --porcelain=v1 --untracked-files=all)" ]]; then echo "Repository contains uncommitted or untracked work; aborting." exit 1 fi ``` 2. Detect interrupted operations such as merges and rebases before changing branches. 3. Verify repository identity using normalized, exact owner/repository values rather than substring matching. Resolve HTTPS and SSH URL forms to the same canonical identifier. 4. Confirm that local commits are reachable from a remote branch before resetting. 5. Create a recovery reference before any destructive operation: ```bash backup_branch="backup/pre-sync-$(date +%Y%m%d-%H%M%S)" git branch "$backup_branch" HEAD ``` 6. Prefer a new clone or isolated Git worktree instead of reusing an arbitrary existing directory. 7. Require explicit confirmation that displays the repository path, current branch, commits that will be replaced, and files that will be discarded. 8. Remove `git clean -fdx` from the default workflow. If cleanup is genuinely necessary, first show a dry run with `git clean -ndx`, obtain explicit approval, and avoid deleting ignored configuration by default. 9. Do not suppress reset errors with `2>/dev/null`; report which branch and command failed so the user can make an informed decision. ]]>