Security audit

git-publish

Security checks for vulnerabilities and agentic risk

Overview

This skill is a GitHub publishing helper, but it can automatically commit and push broad local changes and also adds persistent self-improvement behavior beyond the publishing task.

Review carefully before installing. Use only in repositories where you are comfortable with an agent staging all unignored files, committing them, setting or changing origin, and pushing to GitHub. Avoid using it around secrets, private keys, .env files, customer data, or work-in-progress unless you first inspect the exact files to be committed. Consider removing the repo-map persistence and self-evolution section before use.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:32
Finding: Automatic staging can expose secrets and sensitive files
Content: View full analysis
` to add the remote 5. Run `git branch -M ` to rename to the detected branch name ``` ```markdown ### Step 3: Handle uncommitted changes Check for uncommitted changes with `git status --porcelain`. **If there are uncommitted changes:** 1. Run `git diff --cached` to see staged changes 2. Run `git diff` to see unstaged changes 3. Stage all changes: `git add .` 4. Analyze the staged changes and generate a commit message by summarizing the diff. The commit message should: - Follow conventional commit format: `type(scope): brief summary` - Types: `feat` (new feature), `fix` (bug fix), `chore` (maintenance), `docs`, `refactor`, `style`, `test` - Title no more than 50 characters - Body lists the affected files and what changed 5. Run `git commit -m ""` ``` ### Technical Analysis The Skill instructs the agent to run `git add .`, which recursively stages all unignored content beneath the project directory. It does not require a sensitive-file review, secret scan, staged-file confirmation, or user approval before the resulting commit is pushed to GitHub. The preceding `git diff` instructions are insufficient because they do not necessarily expose the contents of untracked files before those files are staged. Consequently, untracked `.env` files, private keys, credential exports, cloud configuration, database dumps, access tokens, or other confidential artifacts can be committed without meaningful review. This behavior is especially hazardous when the destination repository is public. Deleting the file in a later commit would not remove the secret from e ...[truncated 1233 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:21
Finding: Unvalidated repository URLs are interpolated into Git commands
Content: View full analysis
，直接使用。" 4. **If no mapping is found:** Ask the user to provide the GitHub repository URL. Accept formats like: - `https://github.com/user/repo.git` - `git@github.com:user/repo.git` - `https://github.com/user/repo` ``` ```markdown 2. Run `git add .` to stage all files 3. Run `git commit -m "Initial commit"` 4. Run `git remote add origin ` to add the remote 5. Run `git branch -M ` to rename to the detected branch name ``` ```markdown **If already a Git repository:** 1. Check if a remote named `origin` already exists: - Run `git remote get-url origin` - If the URL differs from what the user provided, ask the user whether to update it - If no remote `origin` exists, run `git remote add origin ` ``` ```markdown - If all 3 HTTPS retries fail, **automatically switch the remote to SSH**: - Convert the URL: `https://github.com/user/repo.git` → `git@github.com:user/repo.git` - Run `git remote set-url origin git@github.com:user/repo.git` - Try pushing again with SSH. ``` ### Technical Analysis The remote URL can originate from user input or the mutable `references/repo-map.json` file. The Skill describes accepted examples but does not require strict parsing, hostname verification, metacharacter rejection, canonicalization, or argument-safe process invocation. If an agent substitutes the URL into a shell command string, s ...[truncated 1763 chars]
Remediation: View remediation
/[.git]` - `git@github.com:/[.git]` 2. Require the hostname to be exactly `github.com`; reject user information, alternate ports, control characters, whitespace, shell metacharacters, URL fragments, and unexpected schemes. 3. Validate owner and repository components against conservative character rules. 4. Invoke Git through an argument-array API, for example the equivalent of: - `["git", "remote", "add", "origin", validatedUrl]` Do not construct a shell command by string concatenation. 5. Canonicalize and display the final remote destination, then require confirmation before the first push or any remote change. 6. Treat values loaded from `repo-map.json` as untrusted input and apply the same validation used for direct user input. 7. Parse the HTTPS URL into structured owner and repository fields before converting it to SSH; do not convert through unrestricted string replacement. 8. After configuration, verify the effective value with `git remote get-url origin` and show it to the user before publishing. ]]>

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:94
Finding: Self-evolution mechanism can persist untrusted instructions across sessions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/repo-map.json:1
Finding: Tracked repository mapping exposes local workstation and project metadata
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
git clone https://github.com/orbisz/git-publish-skill.git .codex/skills/git-publish

text
如果尚未启用 skills 功能，需在 `~/.codex/config.toml` 中添加： ```toml [features]

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented workflow states the skill will automatically stage all modifications and generate a commit before pushing, but it does not prominently warn users that all local tracked and untracked changes may be included. In a publishing skill, this can easily expose secrets, experimental files, credentials, or unrelated work to a remote repository.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill auto-initializes repositories, stages all files, commits all changes, and pushes them, but the description does not warn users about these destructive or privacy-sensitive side effects. In context, this is dangerous because users may invoke a generic 'publish/upload' action without realizing untracked secrets, local-only files, or unrelated changes will be committed and sent to GitHub.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: The push workflow uses a branch name derived from repository state in shell commands and also automatically rewrites the remote from HTTPS to SSH on failure. In a tool-using agent context, this increases risk of unsafe parameter handling and unintended credential-routing or remote-target changes, especially when combined with broad auto-publish behavior and minimal confirmation gates.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
### Step 4: Push to GitHub 1. Detect the current branch: `git branch --show-current` 2. Try normal push first: `git push -u origin <branch>` 3. **If the push fails with a connection error** (e.g., "Could not connect to server", "Failed to connect", timeout, network unreachable), check if the remote URL uses HTTPS protocol: - Run `git remote get-url origin` to inspect the current URL. - If the URL starts with `https://`, retry up to **3 times** with a short pause between retries.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises broad, natural-language trigger phrases for invoking a skill that can initialize a repository, stage all changes, commit, and push to a remote. This increases the chance of unintended invocation from an ambiguous user request, which can lead to accidental publication of code or data without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use this skill whenever the user wants to 'push code to GitHub, publish to a remote, upload a project to GitHub' and includes 'says things like' followed by examples. This trigger guidance is open-ended and lacks negative examples or clear boundaries, which can cause unintended invocation for adjacent requests about remotes or publishing workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow requires the agent to tell the user and ask for input using Chinese phrases, but the file does not state that the skill is Chinese-only or offer language selection. This is a natural-language policy issue because it imposes a specific language regardless of user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction mandates a Chinese confirmation prompt before force-pushing, even though users may be interacting in another language and no locale restriction is documented. Hard-coding a single language without opt-in violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill persists absolute local project paths and associated GitHub URLs in repo-map.json without disclosing the privacy implications. Absolute paths can reveal usernames, internal directory structures, customer names, or confidential project identifiers, creating avoidable metadata exposure on the local system.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill contains self-evolution behavior that writes execution outcomes to a diary and proposes modifying its own SKILL.md via PRs. This is outside the core task of publishing to GitHub and creates an unnecessary persistence and self-modification channel that could record sensitive context or gradually alter the skill without explicit user approval.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.