T09 · Insecure Skill Coding Practices
Error
- Location
- run.sh:34
- Finding
- Unrestricted Git Staging Can Commit and Expose Sensitive Workspace Files## Vulnerability Details **File Location**: `run.sh`, lines 34-55 **Vulnerability Type**: Unrestricted staging of all workspace changes without sensitive-file validation **Risk Level**: High ### Vulnerable Code ```bash FILES=$(git status --porcelain) # File type classification if echo "$FILES" | grep -q "skills/"; then PREFIX="✨ feat:" MSG="스킬 업데이트" elif echo "$FILES" | grep -q "memory/"; then PREFIX="🗃️ memory:" MSG="메모리 파일 업데이트" elif echo "$FILES" | grep -q "\.md$"; then PREFIX="📝 docs:" MSG="문서 업데이트" else PREFIX="🔧 chore:" MSG="작업 파일 업데이트" fi COMMIT_MSG="$PREFIX $MSG" git add -A git commit -m "$COMMIT_MSG" ``` ### Technical Analysis The `commit` action executes `git add -A`, which stages every modified, deleted, and untracked file visible to Git throughout the selected workspace. The preceding classification logic only chooses a commit message; it does not restrict which files are staged. No executable control checks for sensitive paths such as `.env` or `.secrets/`, scans staged content for credentials, verifies `.gitignore`, presents the exact staged set for approval, or enforces the documented confirmation requirement for changes affecting 100 or more files. This directly contradicts the safety rules documented in `GUIDE.md`, lines 61-73. The explicit recognition of `memory/` paths also means persistent agent data may be included in a commit. Although committing such data may sometimes be intentional, the script provides no content-level validation or user confirmation before staging it. ### Attack Path 1. A credential file, secret, private agent-memory file, or other sensitive untracked file is placed or generated under the configured workspace. 2. The user or agent invokes `run.sh commit`. 3. `git add -A` stages the sensitive file together with every other workspace change. 4. The script creates the commit without displaying the final staged file set or re ...[truncated 835 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `git add -A` with explicit staging of user-selected files or a validated allowlist. 2. Reject sensitive path patterns by default, including `.env`, `.env.*`, `.secrets/`, private keys, credential files, token stores, and agent-memory directories unless explicitly approved. 3. Inspect the final staged set with `git diff --cached --name-status` and require confirmation before committing. 4. Integrate secret scanning against staged content and abort when likely credentials, tokens, private keys, or passwords are detected. 5. Check both repository and global ignore rules, while recognizing that ignore rules alone are not a sufficient secret-control mechanism. 6. Enforce the documented large-change safeguard by counting affected files and requiring explicit approval when the threshold is reached. 7. Separate memory-related changes from ordinary source changes and require an explicit opt-in before staging them. 8. Before pushing, display the commits and changed files that will be sent to the remote. 9. Add automated tests proving that sensitive files, large change sets, and unrelated untracked files are not committed without explicit authorization.