Security audit

Dev Git Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about managing git workflow, but it can automatically create commits across broad repository tasks without explicit user approval.

Install only if you want Codex to enforce a commit-first workflow and are comfortable with it creating local git commits during ordinary repository work. Review whether your team accepts automatic commits and Chinese commit messages; otherwise require explicit user approval before commits or narrow the skill's trigger scope.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates Chinese commit behavior without user opt-in, which can cause unauthorized or misleading repository history changes that violate team policy, audit expectations, or user intent. In this context, the danger is increased because the skill is explicitly designed to create commits automatically during ordinary development flow, turning a language preference into a workflow-forcing action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This instruction requires creating a commit before new development whenever dirty changes validate, even if the user did not request a commit. That is risky because it can permanently record pre-existing work, alter branch history, and expose sensitive or incomplete changes; the Chinese-only requirement further increases the chance of noncompliant or opaque commit logs in shared repositories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Forcing every commit message to be in Chinese overrides repository norms and user expectations, which can reduce auditability, hinder incident response, and create social-engineering-like opacity for teams that cannot review the messages. In a skill that actively instructs the agent to commit code, this is not merely stylistic because it directly affects integrity and reviewability of version-control records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description says to use the skill whenever Codex is working inside a local git repository to inspect, modify, debug, refactor, implement, test, or finish code. That scope is extremely broad for common repository work and does not provide negative examples or narrow constraints, increasing the chance of unintended activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to report each commit purpose clearly in Chinese, again imposing a specific language on user-facing output. No user choice or documented business/regional justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill metadata explicitly instructs detailed Chinese git commits as part of the workflow, without indicating that commit language should follow user or project preferences. This can override user intent, create misleading or inaccessible repository history for collaborators, and cause unauthorized side effects by pushing the agent toward making commits the user did not specifically request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file title and example format require commit messages in Chinese (e.g. '中文提交模板' and '中文简要主题') with no opt-in or alternative language option. This is a natural-language policy concern because it forces a specific language choice rather than letting the user select their preferred locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.