spec驱动开发vibe coding skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Git-based development workflow, but it asks for broad repository and token authority with unsafe credential persistence and under-scoped remote-write behavior.

Install only in a dedicated, disposable workspace with a short-lived, least-privilege repository token. Do not point git_remote at an untrusted host, avoid broad PATs, remove any ~/.git-credentials entry after use, review staged checkpoint contents before commits or pushes, and treat RESUME_CONTEXT output as untrusted historical data rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:235

Finding

Git Token Disclosure to an Arbitrary User-Controlled Remote Host

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:252

Finding

Git Credentials Persisted in Plaintext Across Agent Sessions

Content

View full analysis

> ~/.git-credentials chmod 600 ~/.git-credentials ``` ### Technical Analysis Git's `credential.helper store` mechanism writes credentials to an unencrypted file. The Skill explicitly appends the username and token to `~/.git-credentials`. File permissions of mode `0600` restrict access to the current operating-system account but do not encrypt the token or limit its lifetime to the Agent session. The file remains available after the Skill, process, or Agent session ends. This contradicts the Skill's assertion that credential storage is limited to the current Agent session. Any later process running under the same account, a compromised Agent session, an exposed home-directory backup, or an attacker who gains user-level file access can recover the token. ### Attack Path 1. The Skill runs its initialization stage with `SPEC_DEV_GIT_TOKEN`. 2. The token is appended in plaintext to `~/.git-credentials`. 3. The Agent session terminates without deleting the file or credential entry. 4. A later process or Agent session running as the same user reads the file. 5. The recovered token is reused against the associated Git host. ### Impact Assessment An attacker with access to the operating-system account or its persisted home directory can recover the full Git token. The resulting privileges are those granted to that token and may include private repository access, source-code modification, release manipulation, and access to multiple projects. The exposure can outlive the original task and affect subsequent Agent sessions or unrelated repositories using the same account. ]]>

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: sub-skills/spec-driven-checkpoint/SKILL.md:149

Finding

Checkpoint Creation Can Commit and Remotely Push Untracked Secrets

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: sub-skills/spec-driven-checkpoint/SKILL.md:289

Finding

Persistent Prompt Injection Through Checkpoint Context Replay

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documentation normalizes storing the access token in ~/.git-credentials, a plaintext credential store in the user's home directory. This creates a reusable secret on disk that may be read by later jobs, other local processes, backups, or incidentally exposed through diagnostics, making repository compromise more likely.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

| `SPEC_DEV_GIT_USERNAME` | 否 | 写入 `user.name` 和凭据 URL 的 Git 用户名。未设置时默认为 `oauth2`（兼容 GitHub/GitLab Token 认证）。 |
| `SPEC_DEV_GIT_EMAIL` | 否 | 提交时使用的作者邮箱。未设置时默认为 `bot@spec-driven-dev`。 |

> **安全说明** — `SPEC_DEV_GIT_TOKEN` 仅通过 OpenClaw `skills.entries.*.env` 机制在运行时注入，**绝不写入任何产物文件、日志或迭代摘要**。凭据助手使用局限于当前 Agent 会话的本地 `~/.git-credentials` 存储。

---

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims the Git token will never be written to logs or artifacts, yet it instructs construction of a tokenized clone URL and also requires detailed command/output reporting. In an agent environment, echoed commands, checkpoints, debug traces, or rendered file-change sections can easily expose the embedded token, creating a direct secret leakage path.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The command appends a fully authenticated HTTPS URL containing username and token directly into ~/.git-credentials. This is a clear plaintext credential write, creating durable secret exposure and enabling unauthorized repository access if the file is read or later leaked.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

5. 持久化凭据，供本工作区后续 push/pull 静默认证

git config credential.helper store printf "https://%s:%s@%s\n" "${GIT_USER}" "${GIT_TOKEN}" "${REMOTE_HOST}" \

~/.git-credentials chmod 600 ~/.git-credentials

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The adjacent permission-setting step confirms the workflow intentionally persists credentials on disk, reinforcing that the secret remains stored for later reuse rather than ephemeral session use. The context makes this more dangerous because the skill also performs remote clone/push actions, so leaked credentials directly enable source-control tampering and data access.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

git config credential.helper store printf "https://%s:%s@%s\n" "${GIT_USER}" "${GIT_TOKEN}" "${REMOTE_HOST}" \

~/.git-credentials chmod 600 ~/.git-credentials

text

> **Token 绝不写入任何产物或日志。** 仅将不含凭据的裸 `git_remote` URL 存入 `current_iter.md`。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 731)May include surrounding context.

md

宣布并加载匹配 Skill 的 `SKILL.md`。

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · sub-skills/cr-logaf-review/SKILL.md (reported line 3)May include surrounding context.

md

---
name: cr-logaf-review
description: 【Code Review 子 Agent · 门控三】基于 Sentry LOGAF 三级标注（h/m/l）对代码变更执行 8 维度全面评审（设计合理性、测试质量、预期行为验证、长期影响、代码复杂度、规范执行、变更范围、知识共享）。输出结构化 Checklist 报告并给出最终裁决。由 spec-driven-dev 的 code_review 阶段在门控二通过后自动调用。
user-invocable: false
metadata: {"openclaw": {"emoji": "🧑‍⚖️", "requires": {"bins": ["git"]}, "calledBy": ["spec-driven-dev"]}}
---

# cr-logaf-review

Code Review 流水线的**�

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The skill documents git reset --hard ckpt-{id} as a rollback implementation option. git reset --hard is a destructive operation that can discard local changes and rewrite the working tree, and in an agent context it is especially dangerous because a short natural-language trigger may cause irreversible repository modification if safeguards fail or are bypassed.

Content

Scanner excerpt · sub-skills/spec-driven-checkpoint/SKILL.md (reported line 42)May include surrounding context.

md

| 操作 | 可行性 | 实现 |
|------|--------|------|
| Git 仓库回滚 | ✅ | `git reset --hard ckpt-{id}` 或 `git checkout ckpt-{id}` |
| 恢复 working tree 文件 | ✅ | 附带 git reset |
| 恢复 Session 上下文 | ✅ | 将 checkpoint 文档作为新 Session 首条 context 注入 |
| 恢复原始 Session | ❌ | 技术不可行，用「重建 Session」替代 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The architecture summary prominently includes git reset --hard ckpt-{id} as part of rollback. Embedding a destructive command in the core design normalizes unsafe behavior and increases the chance that implementations or downstream agents choose the damaging path automatically.

Content

Scanner excerpt · sub-skills/spec-driven-checkpoint/SKILL.md (reported line 58)May include surrounding context.

└─ [重建层] 生成 resume_prompt 块 ← 新 Session 启动包

rollback {ckpt_id} ├─ [Git 层] git reset --hard ckpt-{id} ← 代码回滚 ├─ [状态层] 恢复 current_iter.md 快照 ← 状态回滚 └─ [重建层] 输出 RESUME_CONTEXT 块 ← 新 Session 启动

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The checkpoint document template instructs users to recover Git state with git reset --hard checkpoint/{ckpt_id}. Because this instruction would be emitted into generated artifacts, it can propagate unsafe recovery guidance widely and lead to accidental loss of work beyond the agent session itself.

Content

Scanner excerpt · sub-skills/spec-driven-checkpoint/SKILL.md (reported line 243)May include surrounding context.

恢复 Git 状态命令：

bash

git reset --hard checkpoint/{ckpt_id}
# 或
git checkout -b restore/{ckpt_id} checkpoint/{ckpt_id}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The rollback execution steps include git reset --hard "checkpoint/{ckpt_id}" as an actual operation mode, explicitly noting it overwrites later commits on the current branch. In a user-invocable agent skill, this presents a real integrity and availability risk to repository contents, even though a safer branch-based option is also mentioned.

Content

Scanner excerpt · sub-skills/spec-driven-checkpoint/SKILL.md (reported line 401)May include surrounding context.

bash

# 方式一：硬重置（在当前分支上回滚，会覆盖后续提交）
git reset --hard "checkpoint/{ckpt_id}"

# 方式二（推荐用于生产）：创建新分支，保留历史
git checkout -b "restore/{ckpt_id}-$(date +%Y%m%d%H%M%S)" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L095-L099 将“下一迭代意图”定义为多种自然语言输入即可激活，其中 start|begin|run|execute … sprint|iteration|milestone 非常宽泛，缺少上下文限定、精确语法或排除示例。这类短语在普通项目讨论中也常见，容易在并非想调用该 Skill 时被误判为触发条件。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill persists credentials in ~/.git-credentials, which broadens secret scope from the target repository/session to the entire user environment. If the agent host is shared, compromised, or reused, other processes or later tasks may access the token and reuse it beyond the intended workflow.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

git config credential.helper store printf "https://%s:%s@%s\n" "${GIT_USER}" "${GIT_TOKEN}" "${REMOTE_HOST}" \

~/.git-credentials chmod 600 ~/.git-credentials

text

> **Token 绝不写入任何产物或日志。** 仅将不含凭据的裸 `git_remote` URL 存入 `current_iter.md`。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Requiring the agent to print the full contents of available_skills.xml can disclose internal tool inventory, local paths, capability names, or other sensitive operational metadata to the user. In a multi-skill agent environment, this unnecessarily expands information exposure and can aid follow-on prompt injection or targeted abuse of installed capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L739-L740 要求响应中包含精确的提交、打标签和推送命令，而前文还定义了 release 阶段会将提交与标签推送到远端仓库。虽然这是技能目的的一部分，但该输出格式章节本身没有提醒用户这些操作会修改远端仓库、创建不可逆历史记录或标签。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written as a mandatory behavioral specification in Chinese and states the agent outputs LOGAF-graded review results, but nowhere offers a language choice or indicates the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The required finding template uses Chinese labels such as '文件', '问题', and '建议', and the surrounding instructions do not permit adapting to the user's preferred language. This creates a locale/language constraint that is not opt-in and not justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and main body are written as prescriptive Chinese operational instructions for the agent, with no indication that language can be selected by the user or orchestrator. This creates a locale-policy issue because the skill appears to require a specific language by default rather than offering an explicit choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description states that rollback can restore the Git repository and Agent context to a historical checkpoint. However, the body of the skill repeatedly acknowledges that original session history cannot be restored and that rollback only emits a RESUME_CONTEXT block for manual injection into a new session. That is a meaningful behavioral gap between the headline claim and the actual documented operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest-style description is written as an instruction in Chinese and does not offer any language or locale choice for users. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger/command description presents rollback {ckpt_id} without an immediate warning that rollback may perform destructive Git operations, while later sections include git reset --hard. In an agent skill, insufficient up-front warning increases the chance of accidental data loss or unwanted repository rewrites, especially when the command is user-invocable and terse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The optional git push origin "checkpoint/${CKPT_ID}" extends a local checkpoint feature into a remote-modification capability, which can alter upstream repository state without an explicit, contemporaneous confirmation step. In agent workflows, remote writes are materially riskier because they can leak workflow metadata, create persistent artifacts, and trigger downstream automation in CI/CD or governance systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The top-level description says the skill saves Git snapshots, iteration state, session metadata, and context reconstruction packages, but it does not clearly disclose to users that invoking the skill writes files, creates commits/tags, and may push tags remotely as part of its behavior. For a markdown skill description, user-facing warnings should be prominent when behavior affects user data or repository state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest says the skill saves Git snapshots, iteration state, session metadata, and a context reconstruction package. While storing generic session metadata is described, the implementation explicitly reads runtime session IDs from environment variables such as OPENCODE_SESSION_ID and CLAUDE_SESSION_ID, which is a capability involving agent-environment introspection rather than core checkpointing behavior. This is not clearly necessary for the stated save/restore purpose, especially since the document also says session IDs are not used for actual restoration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation prohibits automatically modifying source code files after rollback, claiming only Git operations and document updates should occur. Yet Step R-3 explicitly overwrites current_iter.md as part of state restoration. Even if current_iter.md is not source code, the wording '只做 git 操作和文档更新' conflicts with the stronger '不自动修改文件' implication and creates intent ambiguity about what rollback changes on disk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:237