ClawHub
Back to skill

Security audit

git-workflow-and-versioning

Security checks across malware telemetry and agentic risk

Overview

This skill is a Git workflow guide with no executable payload, though users should treat its Git commands as guidance rather than automatic actions.

Install only if you want a Chinese-language Git workflow and versioning assistant. Review before allowing it to run destructive or publishing Git operations such as reset --hard, worktree removal, tag creation, or git push.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list contains broad, common phrases such as commit message, changelog, versioning, and git workflow, which can cause the skill to activate during ordinary development conversations outside the user's explicit intent. Over-broad activation increases the chance that the agent injects this skill's workflow constraints or language/style requirements into unrelated tasks, reducing user control and creating prompt-routing confusion.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill body is predominantly written to operate in Chinese and appears to prescribe Chinese-language interaction patterns without any opt-in or fallback behavior. If auto-activated for users operating in another language, it can override user expectations, degrade usability, and cause the agent to respond in an unintended language, which is a form of unsafe behavior in prompt-driven systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.