T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:72
- Finding
- Commit Requests Automatically Trigger Unauthorized Remote Pushes## Vulnerability Details **File Location**: `SKILL.md`, lines 72-75 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Complete Code Snippet**: ```markdown - **Commit always pushes**: After commit, always push immediately. Do not ask. - Has upstream tracking → `git push` - No upstream tracking → `git push -u origin <branch>` ``` The behavior is operationalized again in the commit workflow at lines 105-108: ```markdown ### Commit (default: commit + push) ```bash git add <files> git commit -m "feat(component): add new feature" && git push ``` ``` ### Technical Analysis The skill treats permission to create a local commit as implicit authorization to modify a remote repository. This violates least privilege because committing and pushing are distinct operations with different effects and authorization boundaries. The skill's declared triggers include commit-only and commit-message requests, but the default workflow mandates an immediate push without asking the user. Consequently, an agent following these instructions can perform a network-visible, remote write that was neither necessary for nor explicitly authorized by the original task. ### Attack Path 1. A user asks the agent to create a local commit or otherwise invokes the commit workflow without requesting a push. 2. The working tree contains intended changes and may also contain accidentally staged, unfinished, or confidential files. 3. The skill stages and commits the selected changes. 4. The mandatory `git push` behavior executes without displaying the destination and obtaining confirmation. 5. The commit is published to the configured remote branch. 6. The remote write may expose data, affect collaborators, or activate repository automation such as CI/CD workflows. ### Impact Assessment The behavior can obtain and exercise the user's existing Git remote-write privileges beyond the sco ...[truncated 652 chars]
- Remediation
- ## Remediation Suggestions - Separate local commit creation from remote push operations. - Remove the rule requiring every commit to be pushed automatically. - Push only when the user explicitly requests a push. - If push intent is ambiguous, display the remote, destination branch, and commits to be sent, then request confirmation. - Do not create upstream tracking branches without explicit authorization. - Before pushing, detect potentially sensitive committed files and warn the user where appropriate. - Keep commit-only requests local and report the resulting commit hash without performing network operations. - Revise the workflow example to: ```bash git add <files> git commit -m "feat(component): add new feature" # Run git push only when explicitly requested or confirmed. ```