Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local file-change safety helper, but it automatically mutates Git repositories and can persist file contents in commits without a separate user confirmation step.
Install only if you want an agent to create local Git recovery commits around file edits. Review target paths carefully, avoid broad generated or secret-containing directories, and be aware that it may initialize Git, set local Git identity, bypass commit hooks, and leave durable local history and .git/.guarded-edit session records.
The skill is presented as a safety gate for file changes, but it also performs additional state-changing operations: initializing a git repository, configuring identity, creating commits, and writing session state under .git. That mismatch can surprise users and downstream agents, causing unintended persistence, history changes, or disclosure of modified content into local commits beyond what the description implies.
Referenced artifact was not completely inspected
File Change Tracker uses a dedicated gitignore-style exclusion file instead of embedding default patterns in `SKILL.md`.
Referenced artifact was not completely inspected
File Change Tracker uses a dedicated gitignore-style exclusion file instead of embedding default patterns in `SKILL.md`.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
{baseDir}/scripts/helper.sh pre "fix login validation" -- src/auth/login.ts src/auth/schema.ts
{baseDir}/scripts/helper.sh pre "create news script and docs" -- scripts/news_hotspot.py scripts/README.md
{baseDir}/scripts/helper.sh pre "update skill metadata" -- SKILL.md README.md README.user.md
{baseDir}/scripts/helper.sh pre "regenerate parser output" -- src/parser generated/
The script is presented as a file-change tracker, but it performs repository-mutating operations such as git init and git config changes inside helper functions used by normal flows. In an agent skill context, this exceeds passive tracking and can silently alter repository state and user configuration expectations, making unintended history and repo mutations likely.
The PRE/POST workflow creates commits for the selected paths, which directly modifies project history rather than merely recording metadata. In a mandatory pre-edit skill, this is dangerous because routine use can create unsolicited commits, interfere with team workflows, and leave durable history changes that the user did not explicitly request.
The use of git commit --allow-empty --no-verify bypasses client-side hooks and permits history mutation even when there is no actual content change. In this skill, that means a mandatory tracking step can silently suppress repository guardrails and inject synthetic commits, undermining policy enforcement and audit expectations.
stage_paths
if ! scoped_staged_diff_exists; then
unstage_paths_best_effort
git commit --allow-empty --no-verify -m "guard(init): $SESSION_REASON" >/dev/null
else
create_scoped_commit "guard(init): $SESSION_REASON"
fi
This second git commit --allow-empty --no-verify path has the same security impact: it can create commits while bypassing pre-commit and commit-msg hooks that may enforce secrets scanning, policy checks, or workflow controls. Because it runs automatically in a helper skill, users may not realize those protections were skipped.
create_scoped_commit "guard(init): $SESSION_REASON"
fi
else
git commit --allow-empty --no-verify -m "guard(init): $SESSION_REASON" >/dev/null
fi
full_head="$(current_head_full)"
The README's user-facing instructions and usage guidance are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy allows locale constraints only when they are optional or clearly justified as region-specific, neither of which is stated here.
The reporting template is written entirely in Chinese and is presented as the required output format. This imposes a specific language on users without opt-in or an alternative, which violates the language/locale policy criteria.
Automatically initializing a repository and setting git identity changes the user's workspace state in a persistent way, even when they may only expect a protective wrapper. Without a prominent warning or opt-in, this can create unexpected repos, alter tooling behavior, and leave audit artifacts that the user did not intend.
The skill explicitly allows non-ignored sensitive files within target paths to be included in snapshots, which can persist secrets or private artifacts in commit history and reflog. In a safety-oriented skill, failing to foreground this privacy risk is dangerous because users may treat the snapshot mechanism as harmless bookkeeping.
need_git_repo automatically runs git init when the current directory is not already a repository. In an agent environment, that can unexpectedly convert arbitrary directories into git repositories, change downstream tool behavior, and create hidden state under .git without user awareness.
The script automatically writes user.name and user.email to the repository config if missing. Although local in scope, this changes repository configuration without consent and can cause misleading commit attribution or violate project policy in repos where identity should be explicitly managed.
The report path prints multiple user-facing status messages in Chinese, such as "最近...次记录" and "文件变更保护状态：", with no option to choose language or detect user preference. This creates a natural-language locale policy issue because the skill imposes a specific language on all users rather than offering opt-in or configurability.
No suspicious patterns detected.