ClawHub
Back to skill

Security audit

OpenClaw Git Workflow

Security checks for vulnerabilities and agentic risk

Overview

This is a local Git workflow helper with normal repository-tooling risks, but no evidence of hidden install behavior, exfiltration, persistence, or destructive code in the included scripts.

Install only if you want a local Git helper. Review git status and diffs before following any commit, push, rebase, merge, or branch-cleanup instruction, and be cautious using it on untrusted repositories because commit messages, filenames, and branch names are displayed directly.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation includes branch cleanup and deletion flows, including examples that delete stale or merged branches, but it does not provide a clear warning that deletion is destructive and may remove unpushed or mistakenly identified work. In an automation-oriented skill, this omission increases the risk of accidental data loss, especially if users trust the tool to safely identify branches for removal.

Unvalidated Output Injection

High
Category
Output Handling
Content
def run_pr_description(args):
    """Generate PR description"""
    # Get branch diff summary
    result = subprocess.run(
        ['git', 'log', f'{args.base}..{args.head}', '--oneline'],
        capture_output=True,
        text=True,
Confidence
88% confidence
Finding
The tool captures git log output derived from repository-controlled commit messages and prints it directly into terminal/markdown output without sanitization. In an untrusted repository, a malicious commit message can contain ANSI escape sequences or crafted markdown/content that manipulates terminal display, hides text, or injects misleading content into downstream PR descriptions.

Unvalidated Output Injection

High
Category
Output Handling
Content
commits = result.stdout.strip().split('\n') if result.stdout else []

    # Get changed files
    result = subprocess.run(
        ['git', 'diff', f'{args.base}...{args.head}', '--name-status'],
        capture_output=True,
        text=True,
Confidence
90% confidence
Finding
Changed file names come from repository content and are emitted directly to stdout in markdown formatting. An attacker controlling file names in a repository can include terminal control characters or deceptive formatting that causes terminal escape injection or misleading rendered PR content.

Unvalidated Output Injection

High
Category
Output Handling
Content
def run_branch_strategy(args):
    """Show branch strategy suggestions"""
    # Get current branch
    result = subprocess.run(
        ['git', 'branch', '--show-current'],
        capture_output=True,
        text=True,
Confidence
78% confidence
Finding
The current branch name is read from git and printed directly to the terminal. If a repository contains a branch name with control characters or deceptive text, this can produce terminal output injection or user-interface spoofing, though the impact is limited to display manipulation.

Unvalidated Output Injection

High
Category
Output Handling
Content
def run_check_branches(args):
    """Check and clean branches"""
    # Get all branches
    result = subprocess.run(
        ['git', 'branch', '-a'],
        capture_output=True,
        text=True,
Confidence
86% confidence
Finding
Branch names from 'git branch -a' are repository-controlled strings and are printed directly to the terminal. Maliciously named branches can contain ANSI/control characters or deceptive text that manipulates terminal output and misleads users reviewing branch information.

Unvalidated Output Injection

High
Category
Output Handling
Content
branches = [b.strip().strip('* ') for b in result.stdout.strip().split('\n') if b.strip()]

    # Get default branch
    result = subprocess.run(
        ['git', 'symbolic-ref', 'refs/remotes/origin/HEAD'],
        capture_output=True,
        text=True,
Confidence
70% confidence
Finding
The default branch name obtained from symbolic-ref is printed without sanitization. Although usually low risk and often controlled by trusted infrastructure, in adversarial repository contexts it can still carry unsafe display characters that lead to terminal output manipulation.

Static analysis

No suspicious patterns detected.