git-workflow-and-versioning

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.0

Overview

This is a Git workflow guide, but it should be reviewed because it recommends destructive and package-resolving commands without enough safeguards.

Install only if you are comfortable with an agent giving Git workflow advice and potentially running Git commands. Before any destructive command such as `git reset --hard`, require an explicit status check, backup or stash, and your approval; prefer local project scripts over unpinned `npx` execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:179
• Finding: Unpinned Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:179` **Vulnerability Type**: Unsafe third-party package resolution and execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npx tsc --noEmit ``` ### Technical Analysis The skill instructs an agent to invoke `tsc` through `npx` without requiring a locally installed, lockfile-pinned TypeScript dependency. If the expected executable is unavailable locally, `npx` may resolve and download a package from the configured package registry before executing it. The instruction does not enforce local-only execution, validate the resolved package, specify an approved registry, or pin an expected package version. This creates a supply-chain trust boundary in a routine pre-commit operation. In particular, the executable name `tsc` does not itself establish that the binary came from the official `typescript` package. ### Attack Path 1. An agent follows the skill's pre-commit checklist. 2. The target repository does not have the expected local `tsc` executable installed. 3. `npx` attempts to resolve the executable using the environment's configured package registry. 4. An unexpected, substituted, or compromised package is downloaded. 5. Package installation hooks or the resolved executable run with the operating-system privileges of the agent. 6. Malicious package code can access data and resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the same privileges as the agent process. Depending on the execution environment, this may expose repository contents, environment variables, developer credentials, package-manager tokens, SSH material, and writable files accessible to the current account. It does not directly grant privileges beyond those already held by the agent, but it could compromise the full scope of that account's accessible workspace and credentials.
• Remediation: ## Remediation Suggestions - Declare `typescript` as an approved development dependency with an exact or lockfile-controlled version. - Require installation from a trusted registry using a committed lockfile and a reproducible command such as `npm ci`. - Prevent `npx` from downloading missing packages: ```bash npx --no-install tsc --noEmit ``` - Prefer a package script that resolves the lockfile-installed binary: ```json { "scripts": { "typecheck": "tsc --noEmit" } } ``` Then run: ```bash npm run typecheck ``` - Fail safely when the dependency is absent rather than allowing automatic registry resolution. - In sensitive environments, verify registry configuration, dependency integrity, and lockfile changes before execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:149
• Finding: Destructive Git Reset Recommended Without Working-Tree Safeguards## Vulnerability Details **File Location**: `SKILL.md:149` **Vulnerability Type**: Unsafe destructive repository operation **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash git reset --hard HEAD ``` ### Technical Analysis The skill recommends `git reset --hard HEAD` as a recovery action when an agent deviates from its intended work. This command resets both the index and tracked working-tree files to the current commit, permanently discarding tracked modifications that have not been committed. The instruction does not require the agent to inspect repository status, distinguish its own changes from pre-existing user work, create a backup, stash modifications, or obtain user confirmation. In a shared or pre-modified working tree, the command can therefore destroy unrelated legitimate changes. This operation does not normally delete untracked files, but it can erase all staged and unstaged modifications to tracked files in the affected worktree. ### Attack Path 1. A user starts the agent in a repository containing uncommitted tracked changes. 2. The agent performs additional work and encounters a failed test or determines that it has deviated from the task. 3. The agent follows the documented recovery guidance and runs `git reset --hard HEAD`. 4. Git replaces tracked working-tree and index content with the version stored at `HEAD`. 5. Both the agent's modifications and unrelated pre-existing user modifications are discarded. 6. If the lost content was not committed, stashed, or backed up elsewhere, recovery may be impossible. ### Impact Assessment The primary impact is loss of integrity and availability of local source-code changes. The command operates with the agent's existing filesystem permissions and affects tracked content in the current Git worktree. It does not itself escalate privileges or affect other repositories, but it may remove valuable work across every tracked file modified since the last c ...[truncated 53 chars]
• Remediation: ## Remediation Suggestions - Require inspection before any destructive recovery operation: ```bash git status --short git diff git diff --staged ``` - Require explicit user approval when the worktree contains changes that cannot be confidently attributed to the agent. - Create a recoverable backup before resetting: ```bash git stash push --include-untracked -m "agent recovery backup" ``` - Prefer restoring only files modified by the agent instead of resetting the entire worktree. - Consider creating a temporary backup branch or patch: ```bash git diff HEAD > /path/to/safe-backup.patch ``` - Use an isolated branch or Git worktree for agent activity so recovery cannot overwrite unrelated user changes. - Revise the skill to state that `git reset --hard` is prohibited unless the tree was clean at task start, all affected changes belong to the agent, a backup exists, and the user has approved the destructive action.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: git-workflow-and-versioning
version: 1.0.0
description: "Manage Git commits, branches, merges, and versioning with structured workflows"

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

�?    └── 功能完成 �?所有提交形成干净历史
```

这个模式意味着你永远不会丢失超过一个增量的工作。如�?agent 偏离轨道，`git reset --hard HEAD` 带你回到上一个成功状态�?
## 变更摘要

任何修改后，提供结构化摘要。这使审查更容易，记录范围纪律，并发现意外变更：

• Confidence: 94% confidence
• Finding: The skill explicitly recommends `git reset --hard HEAD` as a recovery step for an agent that has gone off track. Hard reset is destructive because it discards uncommitted changes, and in an autonomous-agent context it can cause silent data loss or wipe user work if executed without confirmation or situational checks.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes broad phrases like commit message, git workflow, and versioning, which can cause the skill to activate in many loosely related contexts. Overbroad activation increases the chance that the agent applies this skill when unnecessary, leading to unintended git operations or workflow advice in situations where version-control actions were not requested.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The instruction that the skill should always be used for every code change encourages unconditional activation and suppresses context-sensitive judgment. In an agent setting, this can amplify the likelihood of unnecessary repository manipulation, excessive commits, or inappropriate workflow enforcement across unrelated tasks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.