Git Deploy

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:56 AM UTC
• Version: 1.0.0

Overview

This skill does the git deployment work it advertises, but it publishes a repository token and can push all staged local changes without a confirmation step.

Review this skill carefully before installing. Revoke and remove the exposed token, replace the HTTP remote with a secure credential setup, and only run the deploy script after checking git status so unintended files are not committed and pushed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Hard-Coded Git Access Token and Plaintext Repository Endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–25
Vulnerability Type: Hard-coded credential and plaintext transmission configuration
Risk Level: High

Vulnerable Code

markdown

## Repository

- **URL**: http://git.homelab:3000/vitali/SigmaFlow-Svelte.git
- **Token**: c865b793f09a3b79b65ebdfbd75c5b17395188d2

Technical Analysis

The Skill documentation embeds a credential-like Git access token in plaintext. Anyone who can read the distributed Skill package, repository contents, cached copies, logs, or revision history can recover the token and attempt to authenticate to the specified Git service.

The repository URL also uses unencrypted HTTP. If this endpoint or token is used over a network without an independent encrypted transport layer, repository traffic and credentials may be exposed to passive interception or active man-in-the-middle attacks.

The reviewed scripts/deploy.sh file does not directly read this token or configure the documented URL; it runs git push using the current repository's existing Git configuration. Nevertheless, publishing the token is independently unsafe because it makes the secret available to every reader of SKILL.md.

Attack Path

1. An attacker obtains access to the Skill package, source repository, artifact cache, backup, or commit history.
2. The attacker reads SKILL.md and extracts the hard-coded token and Git repository endpoint.
3. The attacker attempts to authenticate to the Git service using the exposed token.
4. If the token remains valid, the attacker performs any repository operations allowed by its assigned scopes.
5. If write access is available, the attacker may modify source code or deployment content, potentially creating a downstream supply-chain compromise.

A network-positioned attacker could additionally monitor or manipulate traffic if the Git service is accessed through the documented plaintext HTTP endpoint.

I

...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke the exposed token immediately and issue a replacement only if it is still required.
2. Review Git service audit logs for use of the token from unexpected users, addresses, or systems.
3. Remove the token from SKILL.md, all repository revisions, release artifacts, caches, backups, and generated documentation where feasible.
4. Store replacement credentials in a dedicated secret manager, operating-system credential store, or protected environment variable. Never include them in source or documentation.
5. Grant the replacement token only the minimum repository permissions required, and apply expiration and rotation policies.
6. Replace the HTTP repository endpoint with HTTPS and enforce certificate validation. Disable plaintext HTTP access where possible.
7. Add automated secret scanning and pre-commit or CI checks to prevent credentials from being committed again.
8. Keep scripts/deploy.sh dependent on securely configured Git credentials rather than embedding credentials in command arguments, files, or remote URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broad enough that it may be invoked for generic deployment or change-publication tasks without making the remote push behavior explicit. In this skill, that ambiguity is more dangerous because the documented workflow automatically stages all changes and pushes them to a configured remote using a built-in token, increasing the chance of unintended code transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation describes automated staging, committing, and pushing but does not prominently warn that this sends repository contents to a remote server. This omission is especially risky here because the skill also exposes a hardcoded access token and remote URL, so a user or agent could unknowingly exfiltrate sensitive local changes or credentials during routine use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell script performs safety-impacting actions: it stages all changes with git add ., creates a commit, and pushes to the remote. Although it logs progress, it does not warn the user about the scope of git add . or ask for confirmation before modifying repository state and transmitting changes upstream.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.