T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:90- Finding
Unsafe Guidance to Copy Existing SSH Private Keys Between Devices
- Content
View full analysis
- Remediation
View remediation
Security audit
Data Sync
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Git/SSH sync workflow, but it asks users to sync sensitive Claude configuration through a fixed root SSH relay and gives unsafe credential-storage guidance.
Install only if you own or explicitly trust the configured relay server and GitHub account, and review every file before pushing. Replace root SSH access with a restricted Git user, generate a unique SSH key per device, do not copy private keys between machines, avoid PATs in URLs or plaintext credential stores, and use stronger secret scanning before syncing Claude configuration, hooks, skills, or memory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:437- Finding
GitHub Personal Access Tokens Are Persisted in Plaintext
- Content
View full analysis
cd /root/git-relay/.git git remote set-url github https://mwangxiang:@github.com/mwangxiang/.git # Method two: use Git credential store ssh root@ git config --global credential.helper store # Enter the username and token during the first push ``` A related command at line 428 also recommends: ```bash git remote set-url github https://@github.com/mwangxiang/.git ``` ### Technical Analysis Embedding a GitHub PAT in a remote URL stores the credential in the repository's Git configuration. The token may additionally be exposed through command history, process inspection, diagnostics, support bundles, terminal recordings, and copied configuration. Git's `credential.helper store` also stores credentials unencrypted, normally in a plaintext credentials file. Describing it as safer does not provide meaningful cryptographic protection against a user or process able to read the account's files. The instructions recommend a PAT with broad `repo` access. Such a token can commonly access multiple private repositories rather than only the repository being archived, increasing the consequence of disclosure. ### Attack Path 1. A user configures the GitHub remote using a PAT embedded in the URL or enables the plaintext credential store. 2. The PAT is written to Git configuration, credential storage, shell history, logs, or related diagnostic output. 3. An attacker who compromises the relay server or obtains readable backups extracts the token. 4. The attacker submits authenticated requests to GitHub using the recovered PAT. 5. Depending on token scope, the attacker reads private repositories, modifies repository contents, creates malicious tags or releases ...[truncated 378 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:696- Finding
Repository Synchronization Uses an Overprivileged Root SSH Account
- Content
View full analysis
.git" cd git remote add relay root@129.211.0.193:/root/git-relay/.git git push relay ``` The registry explicitly configures: ```text IP: 129.211.0.193 User: root Authentication: SSH key Relay directory: /root/git-relay/ ``` Other operations, including repository status checks, GitHub mirroring, and disk-space checks, also execute over SSH as root. ### Technical Analysis Git repository synchronization and status inspection do not require unrestricted administrative access. A dedicated service account with access only to the relevant bare repositories is sufficient. Using `root` violates least privilege and turns theft of a synchronization key into potential full-server compromise. The same credential used for ordinary Git operations can potentially execute arbitrary commands because the instructions do not configure a forced command, restricted shell, repository allowlist, or equivalent SSH restriction. The fixed external endpoint is consistent with the declared relay architecture, so network access itself is not hidden. However, sending Claude configuration, hooks, skills, and memory repositories to that endpoint through an unrestricted root account unnecessarily expands both the privilege boundary and the impact of credential compromise. ### Attack Path 1. An attacker obtains a synchronization SSH private key from a client device, backup, or unsafe key transfer. 2. The attacker connects to `129.211.0.193` using the configured root account. 3. In the absence of server-side forced-command restrictions, the attacker receives root-l ...[truncated 674 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:281- Finding
Broad Git Staging Can Upload Secrets Missed by an Inadequate Scanner
- Content
View full analysis
add -A git -C commit -m "sync: " git -C push relay ``` The same regular expression is repeated at line 586: ```regex (api_key|token|password|secret)\s*[:=] ``` ### Technical Analysis The scanner only detects a narrow set of variable names followed by a colon or equals sign. It can miss numerous credential forms, including: - PEM or OpenSSH private keys - Bearer tokens and authorization headers - Cloud-provider access keys - GitHub token prefixes - Credentials stored in JSON arrays, XML, YAML blocks, URLs, or binary files - Alternative names such as `auth`, `credential`, `accessKey`, `clientSecret`, or `private_key` - Secrets already staged or committed outside the currently examined change set - Sensitive memory or configuration data that is private but does not resemble a credential After this limited check, `git add -A` stages all modifications, additions, and deletions in repositories containing Claude configuration, hooks, skills, memory, and knowledge-base content. Consequently, one missed secret can be committed and sent to the fixed relay. The backup operation may later replicate it to GitHub. Git history retains committed secrets even after deletion from the working tree, so ordinary removal does not fully remediate exposure. ### Attack Path 1. A credential or sensitive file is created under a synchronized repository. 2. Its format does not match the narrow secret-detection expression. 3. `git add -A` stages the file without explicit file-by-file selection. 4. The file i ...[truncated 637 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 如果 git 未安装，提示安装方法
- 如果 SSH 连接失败，引导用户配置 SSH 密钥：
bash ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 # 然后手动将公钥添加到服务器 ~/.ssh/authorized_keys # 或从旧电脑上 scp 已有密钥对
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 如果 SSH 连接失败，引导用户配置 SSH 密钥：
bash ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 # 然后手动将公钥添加到服务器 ~/.ssh/authorized_keys # 或从旧电脑上 scp 已有密钥对
- 如果 SSH 连接失败，引导用户配置 SSH 密钥：
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow normalizes handling GitHub credentials in insecure ways, including embedding personal access tokens in URLs and storing them server-side. In the context of a sync skill that operates across multiple machines and a relay server, this expands the credential exposure surface and can lead to repository compromise if the token is leaked.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This duplicate finding refers to the same personal access token guidance and is valid for the same reason: the documentation operationalizes high-privilege credential use in a way that can expose the token. In a multi-host sync architecture, compromise of one endpoint or the relay can leak access to archived repositories.
- Content
首次 push 时输入用户名和 token，之后自动记住
text 获取 GitHub Personal Access Token：GitHub Settings → Developer settings → Personal access tokens → 创建，勾选 `repo` 权限。 **步骤 5：验证归档**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This duplicate finding refers to the same personal access token guidance and is valid for the same reason: the documentation operationalizes high-privilege credential use in a way that can expose the token. In a multi-host sync architecture, compromise of one endpoint or the relay can leak access to archived repositories.
- Content
首次 push 时输入用户名和 token，之后自动记住
text 获取 GitHub Personal Access Token：GitHub Settings → Developer settings → Personal access tokens → 创建，勾选 `repo` 权限。 **步骤 5：验证归档**
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 1. 绝不删除本地文件 - 所有 git 操作使用安全模式（`--ff-only`、不使用 `--force`） - pull 冲突时报告给用户，不自动覆盖 - **禁止的命令**：`git reset --hard`、`git clean -f`、`git checkout .`、`git push --force` ### 2. 增量优先 - git 天然增量传输，日常同步通常 < 1 MB
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 65% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### 1. 绝不删除本地文件 - 所有 git 操作使用安全模式（`--ff-only`、不使用 `--force`） - pull 冲突时报告给用户，不自动覆盖 - **禁止的命令**：`git reset --hard`、`git clean -f`、`git checkout .`、`git push --force` ### 2. 增量优先 - git 天然增量传输，日常同步通常 < 1 MB
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill states GitHub tokens are never written to tracked files, but its backup workflow instructs users to place a token in a remote URL stored in git config. That persists credentials on disk in plaintext-like form and increases the risk of token disclosure through config inspection, logs, shell history, backups, or accidental sharing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L003 的自然语言描述完全以中文呈现，且全文未说明该技能仅面向特定中文环境，也未提供语言/locale 选择机制。按照该规则，若技能隐含强制特定语言而无用户选择或明确、合理的区域限定，应视为语言/locale 政策问题。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill claims local data is always safe and that operations are only additive, but later instructions recommend stash/pop and rebase or merge-based pulls. Those workflows can rewrite working state, create conflicts, or drop unapplied local edits if handled incorrectly, so the safety guarantee is materially misleading.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L041 将“同步数据”“拉取同步”“推送同步”“数据备份”“同步状态”作为触发词，其中“同步数据”“数据备份”“同步状态”等表述较宽泛，容易与普通对话或其他同步/备份任务重叠。文档虽列出示例触发词，但未提供排除条件或限定必须指向 Claude Code 配置同步场景。
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text claude-config 变更: 修改: skills/ai-auto-dev/skill.md 新增: skills/data-sync/SKILL.md 共 2 个文件
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text claude-config 变更: 修改: skills/ai-auto-dev/skill.md 新增: skills/data-sync/SKILL.md 共 2 个文件 knowledge-base 变更:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
如果有 GitHub token 可用，额外通过 API 验证：
bash curl -s -H "Authorization: token <token>" \ https://api.github.com/repos/mwangxiang/<仓库>/tags | head -20步骤 6：生成归档报告
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file instructs users to perform root-level server operations and to add a remote targeting a root SSH account on a public IP, but it provides no warning about the risks of modifying privileged repositories or operating as root. In the context of a sync tool for sensitive Claude configuration, this increases the chance of accidental destructive changes or compromise of all synchronized data if the root account or relay server is misused.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document uses Chinese throughout and does not offer any language choice or note that the skill is intentionally region- or team-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.