Security audit

Sovereign git-commit-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform the advertised Git reporting task, but its shell script has unsafe input handling that merits review before use in CI or shared repositories.

Use this only on repositories and CI inputs you trust until the script validates numeric and branch arguments and escapes report output. Avoid publishing generated reports unless contributor emails, filenames, commit activity, and commit-message details are acceptable to disclose, and choose output paths carefully because existing files may be overwritten.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/analyze.sh:518
Finding: Command Injection Through Unvalidated Arithmetic Threshold
Content: View full analysis
Remediation: View remediation
100 )); then echo "Error: quality threshold must be an integer from 0 to 100." >&2 exit 1 fi QUALITY_THRESHOLD=$((10#$QUALITY_THRESHOLD)) ``` Apply equivalent strict validation to other numeric inputs, particularly `DAYS` and `TOP_N`, with appropriate upper bounds to prevent malformed arguments and resource-exhaustion behavior. Do not pass untrusted strings directly into arithmetic contexts. Normalize validated values once and use only the normalized integer afterward. Add regression tests for nonnumeric values, arithmetic operators, variable references, array expressions, command substitutions, negative numbers, leading zeros, and values outside `0–100`. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/analyze.sh:104
Finding: Git Option Injection Through the Branch Parameter
Content: View full analysis
/dev/null || true) ``` ```bash stats=$(git log "$BRANCH" "${DATE_ARGS[@]}" --author="$email" \ --pretty=tformat: --numstat 2>/dev/null | \ awk '{ added += $1; deleted += $2; files++ } END { printf "%d|%d|%d", added, deleted, files }') ``` ```bash git log "$BRANCH" "${DATE_ARGS[@]}" "${AUTHOR_ARGS[@]}" \ --pretty=format: --name-only 2>/dev/null | \ ``` ### Technical Analysis The branch name is correctly shell-quoted, which prevents shell word splitting and shell metacharacter interpretation. However, quoting does not prevent the receiving program from interpreting a value beginning with `-` as one of its own options. The user-controlled `BRANCH` value is placed directly into multiple `git log` command lines before an explicit option terminator or validated revision has been established. A value that resembles a supported Git option can therefore modify `git log` behavior instead of selecting a branch. Depending on the installed Git version and supported options, this can alter output processing or cause Git to write output to an attacker-selected path. The script suppresses Git error output and uses `|| true` for the initial collection, which can make malicious or malformed behavior less visible. ### Attack Path 1. An attacker controls the value passed after `--branch` or the `GCA_BRANCH` environment variable. 2. The attacker supplies a string beginning with `-` that Git recognizes as an option rather than a revision. 3. The script forwards the value directly to each `git log` invocation. 4. Git parses the attacker ...[truncated 1025 chars]
Remediation: View remediation
&2 exit 1 fi if ! RESOLVED_COMMIT=$(git rev-parse --verify "${BRANCH}^{commit}" 2>/dev/null); then echo "Error: branch or revision does not resolve to a commit." >&2 exit 1 fi if [[ ! "$RESOLVED_COMMIT" =~ ^[0-9a-fA-F]{40,64}$ ]]; then echo "Error: unexpected resolved object ID." >&2 exit 1 fi ``` Use only `RESOLVED_COMMIT` in every subsequent `git log` call. Where the minimum supported Git version permits it, also use `--end-of-options` when resolving untrusted revisions. Centralize Git-log construction in one function so every invocation receives the same validated object ID and safe options. Add regression tests with values such as `--help`, output-related options, nonexistent refs, ambiguous refs, and valid branch names containing punctuation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze.sh:398
Finding: Unescaped Repository Metadata Produces Injectable JSON and Markdown Reports
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Clone or download this skill into your OpenClaw skills directory:

bash
mkdir -p ~/.openclaw/skills/ cp -r git-commit-analyzer/ ~/.openclaw/skills/

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation encourages generating commit analysis reports and uploading them in CI artifacts without warning that reports may contain contributor emails, commit metadata, filenames, and activity patterns. This can lead to unintended disclosure of personal data or sensitive repository intelligence, especially in shared CI systems or publicly accessible artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrase "commit history" is broad and overlaps with common user requests about repositories, so the skill may activate when a user did not intend to invoke it. This can cause unintended execution of repository-analysis logic, which is mainly a safety and predictability issue rather than direct code-execution risk in this file alone.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrase "contributor stats" is generic and could match ordinary conversational or analytical requests unrelated to this specific skill. In a multi-skill environment, that increases the chance of unintended activation, misrouting, or unexpected access to repository metadata and generated reports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script writes analysis output to a user-supplied path when --output-file is provided, but it does so via shell redirection with no confirmation or warning that an existing file may be overwritten. Although file output is part of the script's purpose, the implementation lacks any user-facing disclosure about the overwrite behavior at the point of the write or in the option description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.