ClawHub
Back to skill

Security audit

Relay GitCode CLI

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate GitCode CLI helper, but it needs Review because it handles credentials and powerful repository changes while documenting unsafe defaults and weak safeguards.

Install only if you trust the `gd` binary source and need an agent to manage GitCode resources. Before authenticating, enable TLS verification, use narrow and revocable tokens, avoid unpinned online installs where possible, and require explicit confirmation before repo moves, delete/recreate syncs, SSH-key deletion, label deletion, pipeline cancellation, or raw API mutations.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/gitcode-workflow-yml.md:96
Finding

Unverified Remote Script Is Executed Directly in CI

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:29
Finding

GitCode API TLS Certificate Verification Is Disabled by Default

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Unpinned Cargo Installation Executes Mutable Third-Party Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
repository, update this `SKILL.md` in the same change so agent workflows stay

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

gd auth status --json

text

Never print, commit, or persist personal access tokens, cookies, or private API
responses in repository files.

## Core Workflows

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-workflows.md (reported line 54)May include surrounding context.

GD_TOKEN="$GD_TOKEN" gd auth status --json

text

Use keyring-backed login for interactive local sessions:

```bash
printf '%s' "$GITCODE_TOKEN" | gd auth login --with-token --json

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-workflows.md (reported line 182)May include surrounding context.

bash
gd ssh-key list --json
gd ssh-key add ~/.ssh/id_ed25519.pub --title laptop --json
gd ssh-key delete key-id --json

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/gitcode-workflow-yml.md (reported line 65)May include surrounding context.

md
## CodeCheck

Use `gd pipeline codecheck` to generate this workflow so the personal access
token is referenced through a project secret instead of committed as a literal
value:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest says this skill should be used when an agent should operate GitCode via local gd commands and explicitly warns against GitHub-only surfaces unless GitCode exposes an equivalent API through gd or gd api. However, the workflow includes online installation via cargo install and fallback downloads from GitHub Releases, which are external GitHub-dependent operations not framed as GitCode API workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents destructive repository operations such as move, sync with update/recreate behavior, and related E2E scripts without consistently requiring confirmation, dry-run guidance, or prominent warnings at the point of use. An agent following these instructions could rename, overwrite, or recreate repositories in the wrong namespace, causing service disruption or data loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest emphasizes using gd for GitCode API v5 workflows and avoiding GitHub-only gh surfaces unless GitCode exposes an equivalent API through gd. But the documented commands gd repo sync-github and gd release migrate-github actively read from GitHub repositories and releases, making the skill a GitHub-to-GitCode migration tool rather than solely a GitCode operator.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

gd auth status --json gd repo view owner/repo --json gd api /user --json gd --api-base https://api.gitcode.com/api/v5 api /user --json

text

Parse-time diagnostics cover unknown commands and flags plus locally known

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly includes --if-exists recreate for repository synchronization, which can delete and recreate an existing target repository. In an agent skill context, showing a destructive command without a clear warning or confirmation requirement materially increases the chance that an automated agent or user will run it and cause irreversible repository loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example shows gd ssh-key delete key-id --json without explaining that deleting an SSH key can immediately revoke repository access for users or automation that depend on it. In a CLI automation skill, omission of that warning can lead to accidental denial of access or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The skill tells the agent to use GD_TOKEN, GITCODE_TOKEN, and stdin-based login that stores credentials in the system keyring. While it later says not to print or persist tokens, this section lacks an immediate warning that authentication commands handle sensitive credentials and should avoid exposure in logs, shell history, or transcripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The default prompt says to use the skill to 'inspect a GitCode repository and manage pull requests with gd,' but it does not define specific trigger phrases, boundaries, or exclusion conditions. In a manifest file, this broad activation wording can make it unclear when the skill should activate versus when other repository-related skills might be more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The markdown lists gd label delete defect --repo owner/repo --json as a workflow example but does not warn that deleting a label removes repository metadata and may affect issue organization. This is a user-data-affecting action that merits a brief caution in the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The document includes gd pipeline stop --repo owner/repo workflow-run-id --json but does not warn that stopping a run can interrupt deployment, testing, or other in-progress automation. Since this may affect system integrity or CI outcomes, the markdown should disclose the impact.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The example installs Rust by piping a remotely fetched script directly into sh, which creates a supply-chain and remote-code-execution risk if the upstream script is compromised, the transport is intercepted, or the URL content changes unexpectedly. In CI workflow guidance, this is more dangerous because users may copy the pattern into privileged automation that runs on every build.

Content

Scanner excerpt · references/gitcode-workflow-yml.md (reported line 100)May include surrounding context.

md
- name: Install Rust stable
        run: |
          cd repo_workspace
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
          "$HOME/.cargo/bin/rustup" component add rustfmt clippy
      - name: Format gate
        run: |

Static analysis

No suspicious patterns detected.