Security audit

Mercurial to Git Converter

Security checks across malware telemetry and agentic risk

Overview

This skill does convert Mercurial repositories to Git, but it can automatically install or download executable tooling and one script can delete an existing target folder without confirmation.

Install only if you are comfortable with shell scripts that can modify your local environment. Prefer installing hg-fast-export yourself from a trusted source before use, run conversions on backed-up repositories, and avoid using hg-to-git-large.sh with any destination path that already exists or contains data you care about.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script silently expands its behavior from local repository conversion into network retrieval and installation of code by cloning hg-fast-export from GitHub when the tool is absent. That creates a supply-chain and trust-boundary risk because running the skill can fetch and then execute externally sourced code without explicit user approval, which is broader than the stated purpose of converting an existing local repository.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script clones external code from the internet into a local directory and then later executes the downloaded hg-fast-export.sh script. This is a classic remote code/supply-chain risk: compromise of the upstream repo, transport path, or an unexpected branch state could result in execution of attacker-controlled code in the user's environment.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script unconditionally performs rm -rf on the target path if it already exists, with no confirmation or safety checks beyond whether the directory exists. If the user supplies an unintended path, or if automation passes a wrong variable, valuable data could be destroyed outside the expected conversion workflow.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script's stated purpose is repository conversion, but it also performs package installation and clones code from GitHub if a dependency is missing. That expands the trust boundary and causes side effects beyond conversion, introducing supply-chain and unexpected network risks for users who may expect a local-only operation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script initiates package-manager operations and external code retrieval without being essential to safely convert a repository. In a developer tool, these networked side effects can unexpectedly modify the host system and expose users to package or upstream compromise risks.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documentation states that `hg-fast-export` will be auto-installed if missing, which implies network access and downloading executable code from GitHub without clearly warning the user or requiring explicit confirmation. In an agent or automation context, this can lead to unexpected supply-chain exposure and unintended system modification, especially if users assume the skill only performs local repository conversion.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The troubleshooting section reinforces that the scripts may auto-install tooling from GitHub, again without a safety notice about external downloads, trust boundaries, or local system changes. This normalizes silent dependency installation and increases the risk of supply-chain compromise or unauthorized environment changes when the skill is used in automated workflows.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The script truncates and recreates the user-supplied output file immediately using shell redirection, with no prompt, backup, or refusal when the target already exists. If a user passes an unintended path or reruns the script, existing data can be silently overwritten, causing accidental data loss; while this is not a code-execution issue, it is a real safety weakness in a filesystem-writing utility.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Recursive deletion without confirmation is dangerous in operational scripts because path mistakes, variable expansion errors, or misunderstood defaults can lead to irreversible data loss. In this skill's context, the behavior is especially risky because repository migration may be run against valuable source trees, and users may assume the tool only creates a Git copy rather than destroying an existing target path.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script downloads or installs software without an explicit upfront warning or consent, so users invoking a conversion utility may unknowingly trigger network access and system changes. This is dangerous because it violates least surprise and can run in sensitive or restricted environments where such actions are unacceptable.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.