gitrakz

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 0.7.2

Overview

The skill has a coherent GitHub activity tracking purpose, but its setup and runtime ask users to trust mutable external installer/container code with a live GitHub token and optional root install.

Review this skill before installing. Prefer the per-user path, avoid `--system` unless you have audited and trust the installer, pin container images by immutable digest where possible, avoid rolling `:latest` with real credentials, and use a dedicated fine-grained GitHub token with only the read access gitrakz needs. Leave LLM settings empty unless you are comfortable sending commit titles or diffs to that endpoint.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:28

Finding

Mutable Remote Installer Can Be Executed with User or Root Privileges

Content

View full analysis

~/.local/bin, config -> # ~/.config/gitrakz, just for the current user. Expects `gh` already present. bash gitrakz-install.sh # 3b. Or system-wide: command -> /usr/local/bin, config -> /etc/gitrakz # (root-owned, readable by the `docker` group so any docker-group user # drives the one shared stack). This mode also installs `gh` if missing. sudo bash gitrakz-install.sh --system ``` ### Technical Analysis The documented installation procedure downloads `install.sh` from the mutable `main` branch of a personal GitHub repository and subsequently executes it. The procedure does not pin the download to an immutable commit or release asset and does not verify a cryptographic checksum or digital signature. Although the instructions tell users to inspect the script and explicitly avoid piping `curl` directly into a shell, manual inspection does not authenticate the publisher or guarantee that the reviewed script corresponds to a trusted release. It also does not provide a reproducible integrity check. The system-wide command executes the downloaded payload through `sudo`, making any compromise substantially more severe. This is a remote payload retrieval and execution risk because the effective installer can change after the Skill itself has been reviewed. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, branch, or release infrastructure, or otherwise obtains the ability to modify `install.sh` on `main`. 2. The attacker adds commands that steal credentials, alter system ...[truncated 977 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/setup.md:72

Finding

Mutable Container Image Can Receive a Live GitHub Authentication Token

Content

View full analysis

" } } } } ``` ### Technical Analysis GitHub synchronization legitimately requires a GitHub credential, and runtime injection avoids writing `GH_TOKEN` to the Skill's `.env` file. However, the credential becomes available to all code executing inside the selected container image. The documentation recommends release tags for normal operation, but tags are not as immutable as content-addressed image digests. More significantly, rolling mode explicitly runs the mutable `:latest` image built from `main`. A compromised image publisher, registry account, build pipeline, or upstream branch could therefore replace the effective executable after the Skill was reviewed. The injected value comes from `gh auth token`, which may be a general-purpose token with privileges beyond the minimum read-only access required for activi ...[truncated 1685 chars]

Remediation

View remediation

`, rather than relying only on a version tag. 2. Sign container images and enforce signature or provenance verification before execution. 3. Disable or remove rolling `:latest` mode from the recommended workflow. If retained for development, require an explicit warning and do not inject production credentials into it. 4. Create a dedicated fine-grained GitHub token with only the read permissions and repository scope required by gitrakz. 5. Do not default to reusing the host user's potentially broad `gh auth token`; support a separately provisioned least-privilege credential. 6. Document the precise GitHub permissions required for synchronization. 7. Apply registry controls that prevent release tags from being overwritten. 8. Consider using a Docker secret or another narrowly exposed runtime secret mechanism where supported. This does not protect against a malicious image, but it reduces incidental exposure. 9. Run the container as a non-root user, use a read-only root filesystem where compatible, drop unnecessary Linux capabilities, and limit outbound network access to required GitHub and explicitly configured endpoints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

permissions:
  network: "Outbound HTTP only to the user-configured GITRAKZ_URL (the local gitrakz server). gitrakz itself shells out to the GitHub CLI and reaches api.github.com to sync activity; point it only at a gitrakz instance the user runs."
  shell: "bash, curl, and the docker / gitrakz-wrapper commands shown in references/setup.md, for user-requested setup or verification. gitrakz reads its GitHub token from `gh auth token`."
  filesystem: "Normal use reads GITRAKZ_URL and GITRAKZ_AUTH_TOKEN from the environment. Setup writes only the owner-only ~/.config/gitrakz/.env and docker-compose.yml."
---

# gitrakz

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 68)May include surrounding context.

md

permissions:
  network: "Outbound HTTP only to the user-configured GITRAKZ_URL (the local gitrakz server). gitrakz itself shells out to the GitHub CLI and reaches api.github.com to sync activity; point it only at a gitrakz instance the user runs."
  shell: "bash, curl, and the docker / gitrakz-wrapper commands shown in references/setup.md, for user-requested setup or verification. gitrakz reads its GitHub token from `gh auth token`."
  filesystem: "Normal use reads GITRAKZ_URL and GITRAKZ_AUTH_TOKEN from the environment. Setup writes only the owner-only ~/.config/gitrakz/.env and docker-compose.yml."
---

# gitrakz

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 107)May include surrounding context.

md

permissions:
  network: "Outbound HTTP only to the user-configured GITRAKZ_URL (the local gitrakz server). gitrakz itself shells out to the GitHub CLI and reaches api.github.com to sync activity; point it only at a gitrakz instance the user runs."
  shell: "bash, curl, and the docker / gitrakz-wrapper commands shown in references/setup.md, for user-requested setup or verification. gitrakz reads its GitHub token from `gh auth token`."
  filesystem: "Normal use reads GITRAKZ_URL and GITRAKZ_AUTH_TOKEN from the environment. Setup writes only the owner-only ~/.config/gitrakz/.env and docker-compose.yml."
---

# gitrakz

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 110)May include surrounding context.

md

permissions:
  network: "Outbound HTTP only to the user-configured GITRAKZ_URL (the local gitrakz server). gitrakz itself shells out to the GitHub CLI and reaches api.github.com to sync activity; point it only at a gitrakz instance the user runs."
  shell: "bash, curl, and the docker / gitrakz-wrapper commands shown in references/setup.md, for user-requested setup or verification. gitrakz reads its GitHub token from `gh auth token`."
  filesystem: "Normal use reads GITRAKZ_URL and GITRAKZ_AUTH_TOKEN from the environment. Setup writes only the owner-only ~/.config/gitrakz/.env and docker-compose.yml."
---

# gitrakz

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

- `GET  /api/v1/templates` — list (built-in + custom).
- `POST /api/v1/templates` — create a custom template.
- `PUT  /api/v1/templates/{id}` — edit (built-ins clone-on-edit).
- `DELETE /api/v1/templates/{id}` — delete a custom template.
- `POST /api/v1/templates/generate` — LLM-compose a template draft from a prompt.
- `POST /api/v1/run` — run a template over a filter → a typed block document.
- `POST /api/v1/export` — export a document / run to `csv | pdf | json`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The document instructs users to download and later execute a remote installer script from GitHub. Although it explicitly warns not to pipe curl to a shell and to inspect the script first, this still creates a supply-chain risk because a compromised repository, branch, or transport endpoint could deliver malicious code that the user may execute locally.

Content

Scanner excerpt · references/setup.md (reported line 27)May include surrounding context.

config files listed below, and installs the gitrakz command — then run it.

bash

# 1. Download (do not pipe curl into a shell).
curl -fsSL https://raw.githubusercontent.com/psyb0t/gitrakz/main/install.sh -o gitrakz-install.sh

# 2. Inspect — read the whole thing.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The setup instructions recommend running the installer with sudo bash, which would execute the downloaded script with full root privileges. If the installer were tampered with or contained unsafe behavior, it could make system-wide changes, install persistence, or expose secrets with complete host compromise.

Content

Scanner excerpt · references/setup.md (reported line 40)May include surrounding context.

3b. Or system-wide: command -> /usr/local/bin, config -> /etc/gitrakz

(root-owned, readable by the docker group so any docker-group user

drives the one shared stack). This mode also installs gh if missing.

sudo bash gitrakz-install.sh --system

text

The mode auto-detects from who runs it (root → system-wide, otherwise

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 68)May include surrounding context.

Wrapper commands

text

gitrakz setup      # refresh compose + .env.example; create .env only if missing
gitrakz start      # inject GH_TOKEN from `gh auth token`, pull, and start
gitrakz stop       # stop the stack
gitrakz status     # container state

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.