my-work-start-helper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:58 PM UTC
• Version: 1.0.0

Overview

This skill transparently performs a work-start Git sync workflow, but it can automatically mutate the active repository from broad trigger phrases without enough confirmation or state checks.

Install only if you want a Chinese-language work-start helper that may modify the current Git repository. Before using it, require the agent to show the repo root, branch, status, remote, and planned commands, then confirm explicitly. Avoid running it in repositories with important uncommitted work or existing stashes unless the stash restoration logic is made specific to the stash it created.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Unqualified Git Stash Restoration Can Apply and Remove an Unrelated Stash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-37
Vulnerability Type: Unsafe Git state handling
Risk Level: Medium

Vulnerable Code

bash

git stash push -m "temp stash before rebase $(date +%Y%m%d%H%M%S)"

bash

git pull --rebase

bash

git stash pop

Technical Analysis

The workflow runs git stash pop without verifying that the preceding git stash push created a new stash and without identifying the exact stash generated by this invocation.

When the working tree has no eligible tracked changes, git stash push does not create a new stash entry. If the repository already contains an older stash, the unqualified git stash pop operates on the current stash@{0}. Consequently, it may apply and remove a pre-existing stash unrelated to the workflow.

The sequence also lacks explicit success checks between the state-changing commands. Restoration should not proceed if stashing or git pull --rebase fails. Because the Skill is activated by a broad conversational trigger and modifies repository state, the absence of confirmation and state validation increases the likelihood of accidental invocation and repository disruption.

Attack Path

1. A repository contains a pre-existing stash created by the user or another process.
2. The tracked working tree has no changes eligible for a new stash.
3. The user invokes the Skill through one of its matching work-start phrases.
4. git stash push creates no new stash entry.
5. The workflow performs git pull --rebase.
6. The unqualified git stash pop selects the existing stash@{0}.
7. The unrelated stash is applied to the working tree and, if application succeeds, removed from the stash list.

Impact Assessment

The issue does not grant additional operating-system privileges or establish persistence. Its scope is the active Git repository and the files represented by the selected stash.

Exploitation ...[truncated 308 chars]

Remediation

View remediation

Remediation Suggestions

1. Ask for explicit user confirmation before running repository-mutating Git commands.
2. Validate that the current directory is the intended Git repository and display its root, branch, and remote before proceeding.
3. Capture the stash list or stash object identifier before and after git stash push and verify that this invocation created a new entry.
4. Restore only the exact stash created by this workflow. Do not use an unqualified git stash pop.
5. Prefer applying the verified stash first and dropping it only after successful application:

   bash

   before="$(git rev-parse -q --verify refs/stash 2>/dev/null || true)"
   
   git stash push -m "temp stash before rebase $(date +%Y%m%d%H%M%S)" || exit 1
   
   after="$(git rev-parse -q --verify refs/stash 2>/dev/null || true)"
   created_stash=""
   
   if [ -n "$after" ] && [ "$after" != "$before" ]; then
       created_stash="$after"
   fi
   
   git pull --rebase || exit 1
   
   if [ -n "$created_stash" ]; then
       git stash apply "$created_stash" || exit 1
       git stash drop "$created_stash"
   fi
   

6. Stop immediately if stashing or rebasing fails. If a rebase conflict occurs, preserve the verified stash and instruct the user to resolve or abort the rebase manually.
7. Clearly report when no new stash was created and skip all restoration commands in that case.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger definition includes broad phrases like “类似表达” without clear boundaries, which can cause the skill to activate on unintended user input. Because this skill performs state-changing Git operations automatically, accidental activation could modify the working tree, create stash entries, or start a rebase at the wrong time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic execution of git stash, git pull --rebase, and git stash pop without a prominent warning or explicit user confirmation that the working tree will be modified and conflicts may occur. In context, this is more dangerous because the skill is triggered by conversational phrases and performs repository-altering actions that can interrupt work, surface conflicts, or complicate recovery if run in the wrong repository or state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document title and all instructional content are written in Chinese, and there is no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.