T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:47
- Finding
- Unrestricted Staging and Remote Publication of Repository Content## Vulnerability Details **File Location**: `SKILL.md`, lines 47–51 **Vulnerability Type**: Unsafe autonomous Git staging and publication **Risk Level**: High ```bash If you wrote code: ```bash git add -A git commit -m "descriptive message" git push ``` ``` ### Technical Analysis The skill instructs an autonomous agent to run `git add -A`, commit, and push whenever it writes code. The `git add -A` command stages all tracked modifications, deletions, and untracked files in the repository rather than limiting the commit to the intended deliverable. No review of the staged diff, secret scanning, file allowlist, branch validation, remote validation, or user confirmation is required before `git push`. Consequently, unrelated work, generated artifacts, private data, or credentials not protected by `.gitignore` can be included in the commit and transmitted to the repository's configured remote. ### Attack Path 1. A sensitive, unrelated, or attacker-controlled file exists or is introduced anywhere in the repository. 2. An autonomous build session writes code and follows the skill's commit procedure. 3. `git add -A` stages the intended work together with every other repository change and untracked file. 4. The agent commits the complete staged set without inspecting it. 5. `git push` transmits the commit to the configured remote. 6. Anyone with access to that remote may retrieve the unintentionally published content; removing it from the latest revision may not remove it from Git history. ### Impact Assessment Exploitation does not directly grant additional local operating-system privileges. Its impact is on the confidentiality and integrity of the repository and its remote: - Disclosure of credentials, tokens, private source code, memory files, or other sensitive artifacts. - Publication of unrelated or incomplete work. - Unauthorized modification of a shared remote branch within the agent's existing Git crede ...[truncated 362 chars]
- Remediation
- ## Remediation Suggestions - Remove unconditional autonomous `git push` guidance and require explicit user approval before remote publication. - Stage only named deliverable paths, for example `git add -- path/to/file`, rather than using `git add -A`. - Inspect the staged content with `git diff --cached --stat` and `git diff --cached` before committing. - Run an appropriate secret scanner against staged content and block commits containing credentials or sensitive material. - Verify the active branch and remote URL before committing or pushing. - Ensure `.gitignore` excludes local secrets, memory data, generated files, and environment-specific artifacts, while recognizing that `.gitignore` is not a substitute for review. - Use protected branches and least-privilege Git credentials that cannot bypass review controls. - Prefer creating a local commit or patch and presenting it for review instead of automatically publishing it. A safer workflow is: ```bash git add -- path/to/intended-deliverable git diff --cached --stat git diff --cached # Run a secret scan and obtain user approval. git commit -m "descriptive message" # Push only after explicit approval and remote/branch verification. ```