Build Session

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed productivity framework, but it tells autonomous agents to commit and push code without review, which could publish unintended files or changes.

Install only if you are comfortable with agents using this skill during autonomous work. Before allowing it to run in a repository, require explicit approval before any commit or push, review git status and the staged diff, stage only intended files, and avoid using it in worktrees that may contain secrets or unrelated changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Overbroad Git Staging Followed by Unreviewed Remote Push

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–55
Vulnerability Type: Unsafe repository staging and publication
Risk Level: Medium

Vulnerable Code

bash

git add -A
git commit -m "descriptive message"
git push

Technical Analysis

The skill instructs an autonomous agent to stage all repository changes with git add -A, create a commit, and immediately push it to the configured remote. The staging command includes every modified, deleted, and untracked path in the repository, not merely files created or intentionally changed during the current build session.

No intervening review, path allowlist, staged-diff inspection, secret scan, or user approval is required before publication. Consequently, unrelated changes or sensitive untracked files already present in the working tree can be included in the commit and transmitted to the repository remote.

This is an insecure workflow rather than evidence of a deliberately embedded malicious payload. Its exploitability depends on sensitive or attacker-influenced content being present in the repository when the instructions are followed.

Attack Path

1. A repository contains an unrelated sensitive, private, unfinished, or attacker-created file in its working tree.
2. An autonomous agent loads SKILL.md and follows its commit instructions after completing a task.
3. git add -A stages the intended deliverable together with all unrelated changes, deletions, and untracked files.
4. The agent commits the complete staged set without reviewing the staged diff.
5. git push transmits the commit to the configured remote.
6. Anyone with access to that remote can retrieve the unintentionally committed content. Removing it in a later commit may not remove it from repository history.

Impact Assessment

The issue does not grant operating-system privilege escalation. Its scope is the contents of the current Git working tree and the configured remote repository.

Potential impact i ...[truncated 382 chars]

Remediation

View remediation

Remediation Suggestions

Replace the broad staging and automatic-push workflow with a least-privilege publication process:

1. Run git status --short and review all working-tree changes before staging.

2. Stage only explicit files created or intentionally modified during the current session, for example:

   bash

   git add -- path/to/intended-file
   

3. Inspect the staged patch before committing:

   bash

   git diff --cached
   

4. Run secret scanning against staged content and reject credentials, private keys, tokens, and sensitive configuration.

5. Require explicit user approval before committing or pushing, especially in autonomous or scheduled sessions.

6. Verify the destination with git remote -v and confirm the current branch before publication.

7. Avoid pushing directly to protected or production branches; use a dedicated branch and pull-request review.

8. If accidental disclosure has already occurred, revoke exposed credentials immediately and purge sensitive objects from repository history where appropriate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's activation guidance is very broad, encouraging use in 'any autonomous time' and for multiple loosely defined session types. That increases the chance an agent will invoke the skill in contexts where repository changes, research, or external engagement were not explicitly authorized, leading to unnecessary or unsafe actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directly instructs the agent to run git add, commit, and push as part of normal operation, without requiring user approval or confirming the target repository/remote. In an autonomous session, this can cause unintended modification of source history and publication of sensitive, incorrect, or unreviewed changes to a remote repository.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.