T09 · Insecure Skill Coding Practices
- Location
SKILL.md:96- Finding
Unbounded Repository Staging and Authenticated Remote Push
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 96-106
Vulnerability Type: Excessive repository mutation and unsafe Git staging
Risk Level: HighVulnerable Code:
bash # エラーログを読み、根本原因を修正 # 関連するテストケースも更新 # ローカルで同じチェックを実行して検証 # 再プッシュ git add . git commit -m "fix: resolve CI failures" git pushTechnical Analysis
The Skill instructs the agent to modify and publish a repository when CI fails on a pull request attributed to the current user. This exceeds the privileges normally required for code review, which should be read-only by default.
The command
git add .indiscriminately stages all modified and untracked files under the current working tree. It does not restrict staging to files intentionally changed while resolving the CI failure. The subsequentgit pushuses the environment's existing Git credentials to publish the commit without requiring explicit user approval, branch verification, staged-diff review, or secret scanning.This creates a confused-deputy risk: unrelated local changes, generated files, credentials, configuration files, or attacker-influenced content could be included in the commit. Although these instructions do not themselves contain malware, they establish an unsafe privileged workflow.
Attack Path
- A user invokes the Skill to review a pull request.
- The Skill detects or is told that CI has failed.
- Repository content or CI output influences the agent into making local changes.
- Unrelated modified or untracked files are present in the working tree, potentially including sensitive files.
- The agent executes
git add ., staging both intended fixes and unrelated content. - The agent creates a commit without inspecting an allowlisted staged diff.
- The agent executes
git pushusing existing authenticated Git credentials. - The unintended content is uploaded to the configured remote repository.
Impact Assessment
The wo ...[truncated 675 chars]
- Remediation
View remediation
Remediation Suggestions
- Make code review read-only by default and separate review from remediation.
- Require explicit user authorization before modifying files.
- Require a second explicit confirmation immediately before committing or pushing.
- Replace
git add .with an allowlist of exact files:bash git add -- path/to/intended-file - Display and validate the staged changes before committing:
bash git diff --cached --stat git diff --cached - Run secret scanning against staged content before publication.
- Verify the repository root, active branch, upstream branch, and remote URL.
- Refuse to push directly to protected or unexpected branches.
- Prefer generating a patch or suggested diff for the user to review and apply.
- Document that CI logs and repository content are untrusted inputs and must not determine commit scope.