Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Git command helper, but one troubleshooting entry recommends a persistent TLS verification bypass that could weaken repository security.
Install only if you are comfortable with a Git helper that may suggest repository-changing commands. Review any destructive Git command before running it, and avoid following the SSL advice to disable certificate verification persistently; prefer fixing the CA/proxy configuration or using a narrowly scoped diagnostic command with an explicit undo step.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Warning
Location
reference/troubleshooting.md:63
Finding
Persistent Disabling of TLS Certificate Verification
Content
View full analysis
Vulnerability Details
File Location: reference/troubleshooting.md, line 63 Vulnerability Type: Persistent insecure Git TLS configuration Risk Level: Medium
Complete Code Snippet:
markdown
- **Fix**: User may need to set `git config http.sslVerify false` temporarily (explain security trade-off) or install correct CA. Prefer directing to IT or host docs.
Technical Analysis
The documented command writes http.sslVerify=false to the repository-local Git configuration. Although the text describes the change as temporary, the command does not apply a temporary override and no restoration command is provided. Certificate verification therefore remains disabled for subsequent HTTPS Git operations performed in that repository.
Disabling certificate validation prevents Git from authenticating HTTPS servers. An attacker capable of intercepting or redirecting network traffic could present an untrusted certificate without Git rejecting the connection.
Attack Path
A user encounters an SSL certificate error while accessing an HTTPS Git remote.
The user follows the documented command:
bash
git config http.sslVerify false
The setting persists in the repository's local Git configuration.
The user subsequently runs an HTTPS operation such as git fetch, git pull, git clone, or git push.
An attacker controlling a network path, DNS response, proxy, or compromised network gateway intercepts the connection and presents an untrusted certificate.
Git accepts the attacker's endpoint because certificate verification is disabled.
The attacker may observe authentication material exposed by the HTTPS exchange, impersonate the remote, tamper with fetched repository data, or intercept pushed content.
Impact Assessment
Exploitation requires a network interception or traffic-redirection position and does not directly grant local operating-system privileges. T
...[truncated 459 chars]
Remediation
View remediation
Remediation Suggestions
Remove the recommendation to persistently disable TLS certificate verification.
Direct users to install or update the correct operating-system or corporate root CA.
Where Git needs an explicit CA bundle, recommend a verified path:
bash
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## Your Workflow
1. **Confirm context**: Ensure Git is on PATH and the user is in (or will run commands in) a repo. If unsure, suggest `git status` or run `scripts/is-repo.sh` from the skill directory.
2. **Safety first**: Prefer read-only commands (`git status`, `git diff`, `git log`). Do not suggest destructive commands (`git reset --hard`, `git clean -fdx`, `git push --force`) unless the user explicitly asks and understands the risk. For recovery, use `git reflog` to find a commit before suggesting reset/checkout.
3. **Give the right level of detail**:
- **Quick answer**: Use the Quick Reference table below and reply with the exact command(s).
- **Step-by-step or edge cases**: Point to or quote from [reference/](reference/) (e.g. [reference/workflows.md](reference/workflows.md), [reference/troubleshooting.md](reference/troubleshooting.md)).
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## Your Workflow
1. **Confirm context**: Ensure Git is on PATH and the user is in (or will run commands in) a repo. If unsure, suggest `git status` or run `scripts/is-repo.sh` from the skill directory.
2. **Safety first**: Prefer read-only commands (`git status`, `git diff`, `git log`). Do not suggest destructive commands (`git reset --hard`, `git clean -fdx`, `git push --force`) unless the user explicitly asks and understands the risk. For recovery, use `git reflog` to find a commit before suggesting reset/checkout.
3. **Give the right level of detail**:
- **Quick answer**: Use the Quick Reference table below and reply with the exact command(s).
- **Step-by-step or edge cases**: Point to or quote from [reference/](reference/) (e.g. [reference/workflows.md](reference/workflows.md), [reference/troubleshooting.md](reference/troubleshooting.md)).
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · reference/troubleshooting.md (reported line 49)May include surrounding context.
md
## Your Workflow
1. **Confirm context**: Ensure Git is on PATH and the user is in (or will run commands in) a repo. If unsure, suggest `git status` or run `scripts/is-repo.sh` from the skill directory.
2. **Safety first**: Prefer read-only commands (`git status`, `git diff`, `git log`). Do not suggest destructive commands (`git reset --hard`, `git clean -fdx`, `git push --force`) unless the user explicitly asks and understands the risk. For recovery, use `git reflog` to find a commit before suggesting reset/checkout.
3. **Give the right level of detail**:
- **Quick answer**: Use the Quick Reference table below and reply with the exact command(s).
- **Step-by-step or edge cases**: Point to or quote from [reference/](reference/) (e.g. [reference/workflows.md](reference/workflows.md), [reference/troubleshooting.md](reference/troubleshooting.md)).
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## Your Workflow
1. **Confirm context**: Ensure Git is on PATH and the user is in (or will run commands in) a repo. If unsure, suggest `git status` or run `scripts/is-repo.sh` from the skill directory.
2. **Safety first**: Prefer read-only commands (`git status`, `git diff`, `git log`). Do not suggest destructive commands (`git reset --hard`, `git clean -fdx`, `git push --force`) unless the user explicitly asks and understands the risk. For recovery, use `git reflog` to find a commit before suggesting reset/checkout.
3. **Give the right level of detail**:
- **Quick answer**: Use the Quick Reference table below and reply with the exact command(s).
- **Step-by-step or edge cases**: Point to or quote from [reference/](reference/) (e.g. [reference/workflows.md](reference/workflows.md), [reference/troubleshooting.md](reference/troubleshooting.md)).
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · assets/gitignore-common.txt (reported line 35)May include surrounding context.
text
.cache/
# Env and secrets (do not commit real secrets)
.env
.env.local
*.pem
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · assets/gitignore-common.txt (reported line 36)May include surrounding context.
text
# Env and secrets (do not commit real secrets)
.env
.env.local
*.pem
# Coverage / test
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · reference/troubleshooting.md (reported line 24)May include surrounding context.
md
- **Fix**:
1. `git pull` or `git pull --rebase`.
2. Resolve conflicts if any, then `git push`.
- **Do not** suggest `git push --force` unless the user explicitly wants to overwrite remote (e.g. after rebase) and understands the risk; then prefer `git push --force-with-lease`.
## Merge or rebase conflicts
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · reference/workflows.md (reported line 18)May include surrounding context.
md
2. Update main: `git switch main` then `git pull`.
3. Create branch: `git switch -c feature/my-feature`.
4. Make changes, then: `git add .` → `git commit -m "message"`.
5. First push: `git push -u origin feature/my-feature`.
6. Later: `git push`.
## Sync with remote when push is rejected
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
91% confidence
Finding
git reset --hard <hash> is a destructive command that can permanently discard uncommitted local changes and overwrite the working tree. Although the document includes a warning to confirm with the user, presenting this recovery step in a reusable workflow still creates risk of accidental data loss if followed carelessly or applied to the wrong commit.
Content
Scanner excerpt · reference/workflows.md (reported line 57)May include surrounding context.
md
## Recover after mistaken reset or checkout
1. `git reflog` — find the commit hash you want (e.g. before `reset --hard`).
2. `git checkout <hash>` to inspect, or `git reset --hard <hash>` to restore that state (destructive; confirm with user).
## Leave detached HEAD
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The primary descriptive text for the skill is presented in Chinese, with no indication that users may choose another language or that the locale is intentionally restricted. For organizational language/locale policy, this can be a natural-language policy issue when no opt-in or justification is provided.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
77% confidence
Finding
This markdown file instructs users to run Bash scripts from the repository root, but it does not include any explicit user-facing warning about how executing scripts can affect the current repository or shell environment. Even though the listed scripts appear diagnostic by name, the README omits a safety note about reviewing script behavior before execution.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
89% confidence
Finding
This markdown reference includes destructive commands such as git restore <path> and git restore ., marked only as 'destructive' in the table, but it does not provide a clear user warning about data loss implications or when to avoid using them. Under the markdown-file criteria, documentation should warn about behaviors that could affect user data or system integrity.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
82% confidence
Finding
The reference lists git push origin --delete <branch> as a normal command entry without a clear warning that it deletes a remote branch and can disrupt collaborators. For markdown skills, operations affecting shared repository state should include an explicit caution about the impact.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
80% confidence
Finding
The local and remote tag deletion commands are presented without any warning about their potentially disruptive or irreversible impact, especially for the remote deletion variant. Markdown guidance should disclose actions that may affect shared repository integrity or collaboration workflows.
