Yeet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.3

Overview

This skill is meant to automate committing and opening a PR, but it uses broad staging, pushing, and dependency installation without enough guardrails.

Use this only in repositories where you have reviewed the full working tree first. Before invoking it, check status and diffs, remove secrets or unrelated files, confirm the remote branch is safe to push, and do not allow dependency or tool installation unless you trust the repository and approve the exact install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Unrestricted staging can publish sensitive or unrelated repository files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–21
Vulnerability Type: Unrestricted file staging followed by remote publication
Risk Level: Medium

Vulnerable Code

markdown

- Confirm status, then stage everything: `git status -sb` then `git add -A`.
- Commit tersely with a conventional commit message: `git commit -m "{type}: {description}"`
- Run checks if not already. If checks fail due to missing deps/tools, install dependencies and rerun once.
- Push with tracking: `git push -u origin $(git branch --show-current)`
- If git push fails due to workflow auth errors, pull from master and retry the push.

Technical Analysis

The workflow uses git add -A, which stages all modifications, deletions, and untracked files throughout the repository. It does not require the agent to inspect the staged diff, verify that each path is related to the requested task, scan for secrets, or obtain user confirmation.

The staged content is subsequently committed and pushed to the configured origin. Consequently, files unintentionally present in the working tree can cross a trust boundary and be transmitted to a remote Git repository. The behavior also conflicts with the narrower instruction to stage “intended changes” in agents/openai.yaml.

Exploitation requires a sensitive or attacker-controlled file to be present inside the repository working tree and not excluded by Git ignore rules.

Attack Path

1. A sensitive or unwanted file is created inside the working tree, such as an environment file, credential export, private key, generated configuration, or unrelated work product.
2. The user invokes the Skill to stage, commit, push, and create a pull request.
3. git add -A stages the file without path-level validation.
4. git commit permanently records the content in Git history.
5. git push transmits the commit to the configured remote.
6. Users, automation, or integrations with acc ...[truncated 815 chars]

Remediation

View remediation

Remediation Suggestions

• Replace git add -A with explicit staging of paths that are directly related to the requested task.
• Display and review both git status --short and git diff --cached before committing.
• Require explicit user confirmation of the staged file list before the commit and push operations.
• Reject or warn about common sensitive paths and extensions, including .env files, private keys, credential exports, authentication files, and generated secrets.
• Run an approved secret scanner against the staged content before committing.
• Separate staging, committing, and pushing into confirmation boundaries so that remote publication is not an automatic consequence of broad local staging.
• If sensitive content is accidentally pushed, revoke exposed credentials immediately and rewrite remote history where organizational policy permits.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unbounded dependency installation can execute repository-controlled package code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Unsafe automatic dependency installation
Risk Level: Medium

Vulnerable Code

markdown

- Run checks if not already. If checks fail due to missing deps/tools, install dependencies and rerun once.

Technical Analysis

The instruction authorizes dependency or tool installation without defining an approved package manager, trusted registry, version policy, lockfile requirement, integrity verification procedure, lifecycle-script policy, or user-approval boundary.

Package installation commonly executes lifecycle, build, post-installation, or compilation scripts. A repository-controlled dependency manifest can therefore cause code execution when the agent attempts to satisfy missing dependencies. The project under audit does not itself contain a dependency manifest or malicious package; exploitation applies when this Skill operates on another repository containing unsafe dependency declarations.

The instruction is also broad enough to permit installation of missing system tools, potentially expanding the effect beyond project-local dependencies.

Attack Path

1. An attacker modifies a target repository’s dependency manifest or lockfile, or supplies a repository containing a malicious, compromised, typosquatted, or dependency-confusion package.
2. Project checks fail because dependencies or tools are reported as missing.
3. Following the Skill instruction, the agent installs the declared dependencies without obtaining approval or validating their origin.
4. The package manager downloads the dependency and executes its lifecycle or build scripts.
5. Malicious code runs with the operating-system privileges, environment access, network access, and filesystem access of the agent process.
6. The code may read accessible credentials, alter repository files, modify build outputs, or use authenticated development tooling available ...[truncated 650 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before installing any dependency or system tool.
• Detect and use only the repository’s expected package manager.
• Enforce immutable or frozen lockfile installation modes and fail when the manifest and lockfile disagree.
• Use approved registries, pinned versions, and available package-integrity verification.
• Review dependency manifest and lockfile changes before installation.
• Disable lifecycle scripts by default where compatible with the project, and enable them only after reviewing the packages that require them.
• Perform dependency installation and checks in an isolated environment with minimal filesystem access, no unnecessary credentials, and restricted network connectivity.
• Never install system-wide tools or elevate privileges automatically; provide installation instructions to the user instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly stages changes, creates a commit, and opens a GitHub pull request, but the user-facing description and default prompt do not warn that it will modify the repository and initiate a remote collaboration action. This can mislead users into invoking a destructive or externally visible workflow without adequate informed consent, especially because staging can include unintended files and PR creation can expose work in progress.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.