GitHub Push CN

• Outcome: Review
• Latest audit: May 28, 2026 · 6:32 AM UTC
• Version: 1.0.0

Overview

This GitHub push helper has a legitimate purpose, but it can delete local Git history and upload or rewrite repository state with too little warning or control.

Install only if you are comfortable with an automation tool that can rewrite local and remote Git state. Use it only on a disposable or backed-up directory, run dry-run first, inspect the exact files and remote yourself, avoid paths containing secrets, and do not use --force on shared branches.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and documents shell-capable behavior but does not declare permissions, which undermines user and platform visibility into what the skill can execute. In a skill that performs git, SSH, and remote-modifying operations, hidden shell capability materially increases the risk of unexpected command execution and repository-impacting actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior indicates materially more invasive actions than the stated purpose suggests, including deleting and reinitializing .git, modifying git identity, staging all files, scanning ~/.ssh, invoking ssh-add, and force pushing. These actions can cause credential exposure, unintended data publication, history rewrites, or destructive repository changes if triggered under user expectations of a merely 'secure push' helper.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The tool unconditionally deletes the existing `.git` directory and reinitializes the repository, destroying local history, remotes, hooks, and configuration. In an agent context this is especially dangerous because it can silently erase provenance and convert an existing repository into a new one before pushing, causing data loss and potentially misleading audit trails.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README advertises a force-push workflow as 'intelligent conflict resolution' and a normal option, but does not clearly explain that force push rewrites remote history and can permanently discard collaborators' commits. In an automation-oriented skill, this framing increases the chance of destructive use because users may treat it as a safe recovery path rather than a last-resort administrative action.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Broad trigger phrases like 'git push' or 'automated push' can cause the skill to activate for common, ambiguous requests where the user did not intend high-impact repository automation. In this context, overbroad matching is more dangerous because the skill can modify remotes, commits, SSH state, and push behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation normalizes force-push and automatic remote modification without a prominent warning, which can lead users to authorize destructive operations without understanding the consequences. Because force-push can rewrite history and remote changes can redirect publication targets, the lack of strong warnings meaningfully raises the chance of accidental data loss or exfiltration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guidance recommends using `--force` to handle upstream rejections, but it does not warn that force-push can overwrite remote history and discard collaborators' commits. In a push automation skill, this is more dangerous because users may follow the advice mechanically during conflict handling, increasing the chance of destructive repository changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API reference documents an automatic escalation from normal push to rebase and then to `git push -f` without an explicit warning, confirmation step, or constraints. In a push automation skill, this is dangerous because it normalizes destructive history rewriting and could cause loss of collaborators' commits or overwrite remote state if triggered during conflict handling.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation states that the tool auto-detects private SSH keys in standard locations but provides no warning about security, privacy, or consent implications. In an automation context, implicit credential discovery increases the chance that the tool will use sensitive keys unexpectedly, especially on shared or multi-account systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Stating that 'SSH keys auto-loaded' with no user-facing warning or consent model implies the skill may access authentication material implicitly. In a push automation context, this is dangerous because it can normalize silent credential use and could enable unintended repository access or pushes using sensitive SSH identities.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples directly demonstrate pushing local files to a remote GitHub repository without clearly warning that repository contents and local paths will be transmitted off-host. In an automation-oriented skill, this omission can lead users or downstream agents to exfiltrate sensitive local files or proprietary data by treating the action as routine.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Documenting a `--force` option without any caution normalizes a potentially destructive operation that can overwrite remote history or bypass safer collaboration workflows. In a push-automation skill, agents or users may invoke it during conflicts without understanding the risk of data loss or disruption to shared repositories.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Repository metadata is removed and recreated without a prominent warning, which creates a hidden destructive side effect. In a push-automation skill, users reasonably expect upload behavior, not irreversible deletion of version-control history, so the skill context makes this significantly more dangerous.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The tool automatically loads SSH keys from `~/.ssh` without clear prior disclosure or consent, which can cause an agent to use credentials the user did not intend to expose for this operation. In an automation setting this increases the risk of unauthorized pushes and surprising credential use across repositories or accounts.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase set includes a very broad match for "github push," which can fire on routine requests and invoke automation in contexts the user did not clearly intend. For a skill that performs repository push operations and SSH/remote configuration, overbroad activation increases the chance of unintended code publication or credential-affecting actions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger "git提交" maps more closely to commit activity than push activity, so the skill may activate for requests that do not imply publishing code remotely. In this skill's context, that mismatch is dangerous because it could escalate a local version-control action into a remote push workflow with conflict handling, SSH setup, or remote reconfiguration.

Static analysis

No suspicious patterns detected.