ClawHub
Back to skill

Security audit

Git Sync

Security checks across malware telemetry and agentic risk

Overview

This is a small git helper for configured local repositories; it has real git read/write power but the behavior is disclosed, bounded, and not deceptive.

Before installing, review the configured repo paths, especially ~/.config/git-sync/repos.json, and only include repositories you are comfortable letting the agent inspect and sync. Treat pull and push as real git write/network actions using your normal credentials, and remember that pull may temporarily stash local changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill invokes shell-capable tooling (`python3 scripts/git_ctrl.py` and the git CLI) but does not declare permissions, which weakens transparency and policy enforcement around command execution. In an agent setting, undisclosed shell capability increases the chance that the skill is enabled or trusted more broadly than intended, especially since git operations can read local repository contents and interact with remotes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior claims only whitelisted repository management by configured names, but the actual behavior reportedly also accepts arbitrary filesystem paths that resolve to an approved repo or subdirectory. That expands the trust boundary beyond the advertised interface and can let a user operate on unintended working trees or sensitive subpaths, making it easier to bypass user expectations and safety review.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The resolver allows any user-supplied path that resolves to a subdirectory under a whitelisted repository, not just the configured repository roots. This weakens the stated security boundary and can cause commands to run against nested repositories, worktrees, or attacker-influenced subpaths inside approved trees, expanding access beyond the manifest's promise.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrase `check repo` is broad and likely to match ordinary conversational requests, which can cause the skill to activate unexpectedly. Because this skill has shell-backed git access and can expose repository state or lead into follow-on write actions, accidental invocation increases the risk of unintended data disclosure or confusing confirmation flows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.