Security audit

Git Manager

Security checks for vulnerabilities and agentic risk

Overview

This Git helper is purpose-aligned, but its packaged entry point can execute unescaped user input through a shell and delegates work to a hard-coded executable outside the reviewed package.

Review before installing. Only use this in a tightly controlled workspace, and do not rely on its stated safety checks until it uses packaged, reviewed executables and passes arguments without a shell. Avoid granting it access to repositories or credentials where an unintended commit, push, or injected command would be costly.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: index.ts:17
Finding: Shell Command Injection Through Unescaped Skill Input
Content: View full analysis
{ exec(`"${path}" ${args.join(" ")}`, { maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => { ``` ### Technical Analysis The Skill reads `action`, `repo`, `message`, `files`, `branch`, and `from` from the invocation input and inserts them directly into a command string. `child_process.exec` evaluates that string through a system shell. Joining arguments with spaces does not preserve argument boundaries or neutralize shell syntax. An attacker who can influence any forwarded string can include command separators, command substitutions, redirections, pipes, or other shell metacharacters. For example, a commit message containing `x; id; #` would place an additional command in the generated shell command. The vulnerability exists before the external Git Manager program receives the arguments. Consequently, safety checks implemented by that program—such as protected-branch enforcement or dry-run behavior—cannot prevent exploitation. ### Attack Path 1. An attacker supplies a crafted Skill input in a field such as `message`, `repo`, `branch`, `from`, `action`, or an element of `files`. 2. The Skill appends ...[truncated 1256 chars]
Remediation: View remediation
{ // Handle the result. } ); ``` 2. Enforce an allowlist of supported actions, such as `status`, `commit`, `push`, `pull`, `branch`, `checkout`, `merge`, `stash`, `log`, and `diff`. 3. Validate repository paths against authorized workspace roots and resolve them canonically before use. 4. Validate branch names with Git-compatible rules and reject control characters, null bytes, and unexpected options. 5. Treat each file as an independent argument rather than combining file names into a comma-delimited string. 6. Insert `--` before file operands where supported to prevent file names from being interpreted as command options. 7. Apply authorization and protected-branch checks in the audited entry point rather than relying exclusively on a downstream executable. 8. Add automated tests using shell metacharacters and command-substitution payloads to verify that inputs remain literal arguments. ]]>

T07 · Tool Hijacking and Spoofing

Warning

Location: index.ts:34
Finding: Unaudited External Executable Can Hijack Git Manager Operations
Content: View full analysis
{ exec(`"${path}" ${args.join(" ")}`, { maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => { ``` ### Technical Analysis The Skill delegates its substantive behavior to an absolute, machine-specific executable outside the audited package: ```text /Users/nico/.openclaw/workspace/skills/git-manager/scripts/git-manager ``` That executable is not included in the supplied project. The package therefore cannot establish its implementation, integrity, ownership, or enforcement of the documented safety controls. The manifest also references different missing implementations—`scripts/git_manager.py`, `scripts/clone_repo.sh`, `scripts/pull.sh`, `scripts/push.sh`, and `scripts/branch.sh`—which do not correspond to the executable used by `index.ts`. If another local process or user can create or replace the file at the hard-coded path, subsequent legitimate Skill invocations will execute the substituted implementation. Because the external program generates the operation result, it can also spoof successful Git output. This attack requires write access to the executable or its parent directories. The audited files do not establish that such access is available to an attacker, but the design lacks package binding or integrity verification and creates a tool-substitution boundary. ### Attack Path 1. An attacker first obtains write access to the hard-coded executable or a relevant parent directory. 2. The attacker creates or replaces `git-manager` with a program under their control. 3. A user or agent invokes the apparently legitimate Git Manager Skill. 4. ...[truncated 922 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is broad enough to trigger on generic mentions of Git, repositories, branches, merges, and versioning, which can cause the skill to be invoked in contexts where the user did not clearly request state-changing operations. Because this skill can commit, pull, merge, and push code, over-broad activation increases the chance of unintended repository modification or remote publication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill presents itself as 'safe' and lists capabilities, but does not clearly warn that several commands are state-changing and that push can publish code to a remote repository. In an agentic environment, missing disclosure materially raises the risk of silent commits, branch changes, merges, pulls, or pushes that affect source history and confidentiality.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 71% confidence
Finding: The skill states that it automatically uses the session's current working directory as the repository when --repo is omitted and can chain multiple Git operations. This creates session-persistence risk because repository context and prior state can implicitly carry across steps, increasing the chance of operating on the wrong repository or performing unintended commits/pushes without a fresh explicit target.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
# Pull git-manager --action pull --repo /path/to/repo --branch main # Create branch git-manager --action branch --repo /path/to/repo --create new-branch --from main # Checkout

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This skill performs real shell-based Git operations immediately, with no visible confirmation or safety gate before potentially destructive actions like push, checkout, branch creation, or operations against attacker-supplied repositories. In an agent setting, lack of explicit consent and guardrails increases the risk of unintended code changes, data exfiltration, or execution of the injected command path described above.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill builds a shell command string from untrusted input fields and passes it to child_process.exec, which invokes a shell. Because values like repo, message, files, branch, and from are concatenated without shell escaping, an attacker can inject additional shell syntax and execute arbitrary commands under the agent's privileges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is written entirely in Chinese, which creates an implicit language constraint in the skill's natural-language interface/metadata. The file does not indicate that language is configurable or that the skill is intentionally region-specific, so this appears to violate the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The "When to Use" section lists only Chinese example utterances, and the OpenClaw session example also uses Chinese, without indicating that other languages are supported or that Chinese is a user-selected preference. This can constitute a locale/language policy issue because the skill presentation implies a fixed language without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.ts:36