ClawHub
Back to skill

Security audit

coding-sop

Security checks for vulnerabilities and agentic risk

Overview

This coding workflow is mostly transparent, but it can stage all repository changes and push them remotely, which could publish unrelated local files.

Install only if you want an agent to manage branches, commits, and remote pushes for coding tasks. Before use, require review of `git status`, the full staged diff, and the exact files to be committed, and keep secrets or unrelated local changes out of the repository. Treat pushes and merges as actions that should receive explicit approval each time.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:130
Finding

Repository-wide staging can publish unrelated or sensitive workspace files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 130–146
Vulnerability Type: Unscoped source-control staging and remote publication
Risk Level: Medium

Vulnerable instructions:

bash
git status
git diff --stat
git add -A
git commit -m "<type>: <description>"
git push -u origin <branch-name>

Technical Analysis

The workflow instructs the agent to run git add -A, which stages every tracked modification, deletion, and untracked file that is not ignored across the repository. The subsequent mandatory commit and push publish that entire staged state to the remote development branch.

The preceding git status and git diff --stat commands only display information. The instructions do not require the agent to reject unexpected files, inspect the complete staged diff, restrict staging to files approved by the design, or obtain explicit confirmation for unexpected content. Consequently, pre-existing workspace changes can cross the boundary from the local filesystem to the remote repository even when they are unrelated to the user's requested coding task.

Attack Path

  1. An unrelated user, process, tool, or earlier task leaves a modified or untracked file in the repository workspace.
  2. The coding SOP is invoked for a separate development request.
  3. At the commit stage, the agent executes git add -A, staging both the authorized implementation and the unrelated file.
  4. The agent commits the complete staged state.
  5. The agent executes git push -u origin <branch-name>.
  6. The unrelated content becomes accessible to users or systems with access to that remote branch.

This path does not require a force push or publication to main or master; disclosure can occur through an ordinary development branch.

Impact Assessment

The operation uses the agent's existing repository write credentials. Its scope is limited to content present in the current re ...[truncated 538 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace git add -A with explicit staging of only the files listed in the approved design, such as git add -- path/to/file1 path/to/file2.
  • Record the expected file set before coding and fail closed when git status --porcelain reports unexpected paths.
  • Review the complete staged patch with git diff --cached --stat and git diff --cached before committing.
  • Scan staged content for credentials and other sensitive material before publication.
  • Require explicit user confirmation if unrelated pre-existing changes must be included.
  • After committing, verify the exact commit contents with git show --stat --name-status HEAD before pushing.
  • Preserve the existing prohibition on force pushes and the requirement for explicit approval before pushing to the main branch.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The skill operationalizes git push as part of a default workflow, which can cause unreviewed or sensitive code changes to be transmitted to a remote repository. In an agent setting, any instruction that normalizes automatic remote state modification is high risk because it can leak proprietary code, secrets, or malicious edits outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

git checkout main || git checkout master git pull git merge --no-ff -m "merge: " git push

text
- 合并推送同样需要执行推送结果验证

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description is written as an instruction for using this workflow and specifies triggers and operating guidance entirely in Chinese, but it does not offer any language choice or state that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.