ClawHub
Back to skill

Security audit

Git Sync

Security checks for vulnerabilities and agentic risk

Overview

This git helper is mostly coherent, but it can push or pull configured repositories using the user's Git credentials with only a command-line flag as confirmation.

Install only if you are comfortable with an agent running git status, fetch, pull, and push on the configured repositories. Before using write operations, inspect ~/.config/git-sync/repos.json, keep it limited to repositories you intend to manage, and require your workflow or agent runtime to ask you explicitly before adding --confirm, because the script itself cannot verify that approval.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/git_ctrl.py:140
Finding

Write-operation confirmation is enforced only through a caller-controlled flag

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises shell-based operational capability via python3 scripts/git_ctrl.py ... but does not declare any explicit tool scope such as permissions or allowed-tools. Without a restrictive tool declaration, an agent runtime may grant broader shell access than intended, increasing the chance that a prompt-injection or implementation bug could execute unintended commands beyond the documented git workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill allows persistent configuration from ~/.config/git-sync/repos.json, which lets behavior be altered by external state across sessions. If that file is modified by another process or user, the whitelist of repositories could be expanded or redirected to sensitive paths, undermining the stated security model and potentially causing the agent to operate on unintended repositories.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
- git CLI (https://git-scm.com)
description: >
  Manage whitelisted git repositories from chat. Status, log, diff, pull, push
  with security controls — only approved repos, write commands need confirmation.
  Repo list configurable via ~/.config/git-sync/repos.json (overrides defaults).
  Triggers on "git status", "repo status", "push thesis", "pull polito",
  "check repo", "uncommitted changes", "commit recenti".

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

The script persists trust and authority across sessions by loading the allowed repository list from ~/.config/git-sync/repos.json without integrity checks or ownership validation. If that file is modified by another local process, compromised agent context, or social-engineered user action, later invocations may treat attacker-chosen paths as whitelisted and enable confirmed write operations like pull and push against unintended repositories.

Content

Scanner excerpt · scripts/git_ctrl.py (reported line 4)May include surrounding context.

python
#!/usr/bin/env python3
"""Secure git repository manager for whitelisted repos.

Read-only commands run freely. Write commands require --confirm flag.
Repo list loaded from config file or defaults.

Usage:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_ctrl.py (reported line 65)May include surrounding context.

python
def run_git(repo_path: str, args: list[str], timeout: int = 30) -> dict:
    cmd = ["git", "-C", repo_path] + args
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return {"returncode": result.returncode, "stdout": result.stdout.strip(), "stderr": result.stderr.strip()}
    except subprocess.TimeoutExpired:
        return {"error": f"Command timed out ({timeout}s)"}

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes the skill as supporting status, log, diff, pull, and push for whitelisted repositories, but the code also exposes branch listing and fetch operations. These are real user-facing capabilities not mentioned in the manifest, so the implementation exceeds the described behavior even though they are related to git management.

Content

No source excerpt is available for this finding.