T09 · Insecure Skill Coding Practices
Error
- Location
sal/git_isolation.py:77- Finding
Repository-Wide Git Operations Can Commit or Destroy Files Outside the Declared Target Scope
- Content
View full analysis
str: """Stage all changes and commit. Args: message: Commit message. Returns: Short SHA of the new commit. """ self._run("add", "-A") self._run("commit", "-m", message, "--allow-empty") sha = self.current_short_sha() self._last_good_commit = sha return sha def rollback(self) -> None: """Reset to last known good commit. Discards all uncommitted changes and resets to the last commit that passed verification. """ if self._last_good_commit: self._run("reset", "--hard", self._last_good_commit) else: self._run("reset", "--hard", "HEAD") # Clean untracked files self._run("clean", "-fd") ``` The repository-wide commit is invoked after a successful metric comparison: ```python if improved: # KEEP — commit changes sha = self.git.commit( f"sal: {hypothesis['description']} " f"(metric: {metric_value:.6f})" ) ``` ### Technical Analysis The Skill declares that the agent modifies exactly one configured `target_file`. However, the implementation neither checks the Git diff against that target nor restricts staging to the target. `git add -A` stages every tracked, modified, deleted, and newly created file in the repository. Consequently, unrelated user changes or unauthorized agent changes can be included in an accepted experiment commit. The rollback path is also repository-wide: - `git reset --hard` discards all tracked working-tree modifications. - `git clean -fd` recursively deletes untracked files and directories. - The implementation does not require a clean working tree before starting. - It does not snapshot or distinguish pre-existing user changes from changes prod ...[truncated 1631 chars]- Remediation
View remediation