T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:12- Finding
Arbitrary Command Execution Through Shell Command Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Git Workflows Advanced
Security checks for vulnerabilities and agentic risk
Overview
This Git automation skill is broadly purpose-aligned, but its implementation can turn tool inputs into arbitrary shell commands and make repository changes without strong safeguards.
Do not install this version in an agent environment that may receive untrusted branch names, paths, tags, URLs, PR text, or other tool inputs. The skill should be revised to remove shell=True, pass subprocess arguments as arrays, validate refs and paths, constrain worktree destinations, and require explicit confirmation or dry-run previews for force-updates, subtree imports, and PR creation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/run.py:73- Finding
Workspace Boundary Bypass Through Unrestricted Worktree Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description is only partially accurate. The code does cover several declared Git workflow areas: worktree management, reflog recovery, subtree addition, and PR creation. However, there are material discrepancies. First, declared capabilities for submodule handling and cherry-pick across forks are absent. Second, the interactive rebase functionality does not actually execute an interactive rebase; it inspects commits and returns instructions plus an autosquash note, which is weaker than the declared 'advanced Git operations as tools' wording. Third, the code includes an additional capability—changelog generation—that is not mentioned in the description. These differences are substantive enough to count as a description-behavior mismatch.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
This is a classic tool-parameter-abuse issue: attacker-controlled tool inputs are embedded into shell commands executed with shell=True. Because nearly every high-level function forwards JSON fields into these commands, a crafted parameter can break out of the intended Git/GitHub CLI invocation and execute arbitrary shell commands on the host.
- Content
python def run(cmd, cwd=None): """Run a command and return (returncode, stdout, stderr)""" result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd) return result.returncode, result.stdout, result.stderr def git_rebase_interactive(base, autosquash=False):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill exposes high-risk Git operations such as reflog restore and subtree modification under danger_full_access while explicitly noting that extra confirmation for truly dangerous actions is 'not yet implemented.' In an agent setting, this can lead to unintended history rewrites, branch corruption, or repository state changes without a strong human confirmation boundary.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The helper uses subprocess.run(..., shell=True) and many callers interpolate untrusted JSON-derived parameters directly into shell command strings. This enables command injection across multiple tools such as branch names, paths, tags, repo URLs, PR title/body, and commit hashes, allowing arbitrary OS command execution in the agent environment.
- Content
python def run(cmd, cwd=None): """Run a command and return (returncode, stdout, stderr)""" result = subprocess.run(cmd, shell=True, capture_output=True, text=True, cwd=cwd) return result.returncode, result.stdout, result.stderr def git_rebase_interactive(base, autosquash=False):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
git branch -f force-moves the target branch to a supplied commit without any confirmation or safety check. In an agentic context, this can silently rewrite branch state, discard expected history references, and facilitate destructive repository tampering or recovery-point manipulation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This function performs network fetches and working-tree modifications by adding a remote, fetching, and adding a subtree, yet provides no warning or confirmation. In agent use, this can import untrusted code or unexpectedly alter repository contents, which is more dangerous because the skill is designed to make repository-changing operations easy to trigger.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Most of the manifest describes advanced Git repository operations such as rebase, worktree management, reflog recovery, and subtree/submodule handling. Creating a PR through gh invokes a hosted GitHub workflow and performs remote side effects beyond core git operations, which is a distinct capability unless explicitly and clearly in scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
PR creation sends branch metadata and user-provided content to GitHub and creates a remote artifact without any explicit consent gate. In an automation setting, this can leak repository context externally or trigger unintended publication/actions, especially when combined with command injection elsewhere in the file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes advanced Git workflows centered on rebase, worktrees, reflog recovery, subtree/submodule handling, cherry-pick across forks, and PR automation. This file adds a git_changelog_generate capability that is not mentioned, while there is no implementation of submodule handling or cherry-pick across forks, indicating the delivered behavior does not match the stated skill scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Adding an external repository as a subtree causes both network access and local repository modification, but the documentation does not provide concrete warnings, trust guidance, or approval requirements. In practice, this can import untrusted code or unexpectedly alter the repository state, which is more sensitive in an autonomous agent workflow.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The manifest specifically frames PR automation as being based on human-written intent, suggesting constrained assistance around user-authored PR content. The implementation simply accepts title and body strings and issues gh pr create, with no logic enforcing or reflecting that claimed intent-oriented behavior.
- Content