T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:144- Finding
Shell command injection through the user-controlled PR title
- Content
View full analysis
- Remediation
View remediation
Security audit
submit pr
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent PR-submission helper, but it has review-worthy safety gaps around shell-handling the PR title and incomplete secret scanning before pushing code.
Install only if you are comfortable with a skill that can stage, commit, push, and create GitHub PRs. Before using it, manually review untracked files and secrets, and avoid passing PR titles containing shell metacharacters, quotes, command substitutions, or newlines until the skill is revised to validate the title and scan the exact staged snapshot.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
``` ### Technical Analysis The Skill states that all pending changed files must be scanned before a commit is created. However, `git diff HEAD --name-only` only reports changes represented in Git's tracked-file diff. It does not enumerate ordinary untracked files. Consequently, a newly created file can be absent from the Step 1 scan even though later workflow steps display it through `git status`, allow the user to confirm it, and stage it with `git add`. The workflow can then report that the sensitive-i ...[truncated 1563 chars]:47- Finding
Secret scanning omits untracked files that may later be committed
- Content
View full analysis
``` ### Technical Analysis The Skill states that all pending changed files must be scanned before a commit is created. However, `git diff HEAD --name-only` only reports changes represented in Git's tracked-file diff. It does not enumerate ordinary untracked files. Consequently, a newly created file can be absent from the Step 1 scan even though later workflow steps display it through `git status`, allow the user to confirm it, and stage it with `git add`. The workflow can then report that the sensitive-information scan passed without ever inspecting that file. The issue affects both content-based secret patterns and sensitive filenames. For example, an untracked `.env`, private-key file, or source file containing an API token can bypass the documented scanner and subsequently enter the commit. ### Attack Path 1. A sensitive file is created in the repository as an untracked file. 2. Step 1 obtains its scan list using `git diff HEAD --name-only`. 3. Git omits the untracked file from that output, so its filename and contents are not scanned. 4. Step 2 obtains repository status and presents the new file for confirmation. 5. The user confirms the file, or does not recognize that it was excluded from the earlier scan. 6. The Skill stages the file with `git add`. 7. The file is committed, pushed to the remote repository, and included in the pull request. ### Impact Assessment This flaw can expose secrets to the remote Git repository and everyone who can access its objects or pull requests. Potentially exposed material includes: - API keys and bearer tokens. - GitHub access tokens. - Cryptocurrency private keys or mnemonic phrases. - Environment configuration containing credentials. - PEM, keystore, or other private-k ...[truncated 217 chars]- Remediation
View remediation
``` - Abort the workflow if the staged file set differs from the previously scanned and confirmed set. - Prefer a mature secret-scanning tool with entropy detection and well-maintained credential patterns, while retaining explicit sensitive-filename checks. - Record which exact Git object or staged snapshot was scanned so the scan result cannot become stale before commit creation. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions explicitly require commit subjects to be written entirely in English and forbid Chinese characters. This is a natural-language policy concern because it forces a specific language choice rather than offering the user a language or locale option.
- Content