Mercurial to Git Converter

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

This Mercurial-to-Git conversion skill is purpose-aligned, but it can automatically install or run unverified external tooling and one script can delete an existing target directory without confirmation.

Install only if you are comfortable with scripts that may change system packages, download hg-fast-export from GitHub, leave a copy under your home directory, and write or delete destination repository paths. Use a fresh empty target directory, back up important data, and prefer preinstalling a trusted hg-fast-export version before running the scripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/hg-to-git.sh:56

Finding

Unpinned Remote Dependency Is Downloaded and Executed

Content

View full analysis

/dev/null && ! command -v hg-fast-export.sh &> /dev/null; then FAST_EXPORT_DIR="${HOME}/.local/share/hg-fast-export" if [ ! -d "$FAST_EXPORT_DIR" ]; then mkdir -p "$(dirname "$FAST_EXPORT_DIR")" git clone https://github.com/frej/fast-export.git "$FAST_EXPORT_DIR" fi export PATH="$FAST_EXPORT_DIR:$PATH" fi # Determine fast-export command if command -v hg-fast-export &> /dev/null; then FAST_EXPORT_CMD="hg-fast-export" elif command -v hg-fast-export.sh &> /dev/null; then FAST_EXPORT_CMD="hg-fast-export.sh" elif [ -f "${HOME}/.local/share/hg-fast-export/hg-fast-export.sh" ]; then FAST_EXPORT_CMD="${HOME}/.local/share/hg-fast-export/hg-fast-export.sh" ``` ```bash # Perform conversion echo "" echo "Converting... (this may take a while for large repos)" "$FAST_EXPORT_CMD" -r "$HG_REPO" --force ``` ### Technical Analysis When `hg-fast-export` is unavailable, the script clones the current contents of an external GitHub repository and subsequently executes `hg-fast-export.sh`. The clone is not pinned to a reviewed commit or immutable release, and no checksum or cryptographic signature is verified. Consequently, the code executed during conversion can differ from the code that existed when this Skill was audited. Compromise of the upstream repository, its default branch, its maintainers, or the network trust chain could cause attacker-controlled code to be placed in the installation directory and executed. The script also trusts an existing `${HOME}/.local/share/hg-fast-export` directory without validating its ownership, contents, or integrity. An attacker who can prepopulate that location may be able to influence the executa ...[truncated 1207 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/hg-to-git-large.sh:50

Finding

Large-Repository Converter Downloads and Executes an Unpinned Remote Script

Content

View full analysis

&1 | while read line; do if [[ $line == *"revision"* ]]; then echo -n "." else echo "$line" fi done ``` ### Technical Analysis The large-repository converter performs a shallow clone of the current default branch of an external repository and immediately treats a script from that clone as executable conversion tooling. A shallow clone does not provide integrity or immutability: it still retrieves whichever commit the remote default branch references at execution time. No approved commit identifier, release version, checksum, or signature is checked. The script also accepts an already existing `${HOME}/.local/share/hg-fast-export` directory without validating its ownership or contents. This behavior creates a remote payload execution channel in which the effective code can change after the Skill package has been reviewed. ### Attack Path 1. A user runs `scripts/hg-to-git-large.sh` without `hg-fast-export` available in `PATH`. 2. The script clones the external dependency's current default branch, or reuses an existing local dependency directory. 3. The upstream repository or local directory contains an attacker-modified `hg-fast-export.sh`. 4. The script performs no integrity verification. 5. The attacker-controlled script is executed with the source repository path as ...[truncated 518 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/hg-to-git-large.sh:60

Finding

Unconditional Recursive Deletion of a User-Supplied Target Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (13)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/hg-to-git.sh (reported line 51)May include surrounding context.

sh

# Try different installation methods
    if command -v apt-get &> /dev/null; then
        sudo apt-get update && sudo apt-get install -y hg-fast-export 2>/dev/null || true
    elif command -v brew &> /dev/null; then
        brew install hg-fast-export 2>/dev/null || true
    fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description focuses on conversion benefits but omits that the process creates or modifies a target Git repository path. Users may run it against an unintended directory and lose or overwrite data, especially because repository-conversion tooling often performs many filesystem writes as part of initialization and import.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that missing dependencies are auto-installed from GitHub, but it does not clearly warn users that running the skill may fetch and execute third-party code from the network. This creates a supply-chain risk and can surprise users operating in restricted or security-sensitive environments where implicit downloads are not acceptable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script silently expands its behavior from local repository conversion to installing external tooling over the network at runtime. This is dangerous because it introduces supply-chain risk, executes unpinned third-party code, and violates least surprise for a conversion utility that users may expect to operate only on local repositories.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script clones executable conversion tooling from GitHub at runtime and then uses that tool, effectively trusting remote code without verification. If the upstream repository, transport, or local environment is compromised, the script could execute attacker-controlled code on the user's system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script unconditionally deletes the target path with rm -rf if it already exists, without confirmation or safety checks beyond variable quoting. A mistaken argument, automation bug, or unexpected path value can destroy user data and make recovery difficult.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's stated purpose is repository conversion, but it also performs package installation and fetches code from the network. This expands the trust boundary and can execute unreviewed or tampered external code during a local migration task, which is risky especially in automation or privileged environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script installs software and clones code without explicit informed consent, beyond a generic status message. That can surprise users, change system state, and pull in untrusted code paths, which is particularly problematic for a tool expected to perform a deterministic repository conversion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The network and software-installation behavior is not strictly necessary to convert an existing local repository and is not clearly disclosed as a side effect. This makes the skill more dangerous because users may invoke it expecting offline file conversion but instead trigger package manager actions and a GitHub clone.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Invoking sudo inside a repository conversion helper can elevate a simple content migration task into privileged system modification. If run by a user who can authenticate sudo, the script may install packages and alter the system with root privileges, increasing the blast radius of mistakes or supply-chain compromise.

Content

Scanner excerpt · scripts/hg-to-git.sh (reported line 51)May include surrounding context.

sh

# Try different installation methods
    if command -v apt-get &> /dev/null; then
        sudo apt-get update && sudo apt-get install -y hg-fast-export 2>/dev/null || true
    elif command -v brew &> /dev/null; then
        brew install hg-fast-export 2>/dev/null || true
    fi

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script unconditionally truncates or creates the output file using shell redirection before checking whether the target already exists. If a user passes an existing path, especially via the optional output-file argument, important local files could be overwritten or destroyed, causing data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Automatically downloading hg-fast-export without prior user opt-in is a risky side effect for a repository conversion script. While less severe than arbitrary execution by itself, it still creates unanticipated network activity and broadens the trust boundary to external infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Writing a cloned dependency into the user's home directory without clear notice creates persistent side effects outside the target repository. While lower impact than privileged installation, it still modifies user state unexpectedly and may leave behind unreviewed executable content on PATH.

Content

No source excerpt is available for this finding.