T09 · Insecure Skill Coding Practices
- Location
SKILL.md:97- Finding
Unscoped Staging and Autonomous Remote Repository Push
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:97-106
Vulnerability Type: Unsafe repository mutation and remote publication
Risk Level: MediumComplete Code Snippet:
markdown 2. **修正を実施**: - エラーログを読み、根本原因を修正 - 関連するテストケースも更新 - ローカルで同じチェックを実行して検証 3. **再プッシュ**: ```bash git add . git commit -m "fix: resolve CI failures" git push ```Technical Analysis
The Skill is declared as a code-review assistant, for which read access to source files, diffs, and CI results is normally sufficient. However, this workflow directs the Agent to modify the working tree, stage all unignored changes with
git add ., create a commit, and push it to a remote repository.git add .is not scoped to files intentionally changed while addressing the CI failure. It can include unrelated pre-existing changes, generated artifacts, local configuration, or accidentally created sensitive files. The workflow does not require the Agent to:- Obtain explicit user approval before modifying, committing, or pushing.
- Restrict staging to specifically reviewed paths.
- Inspect the staged diff before committing.
- Scan staged files for credentials or other sensitive data.
- Confirm the intended branch and remote destination.
The behavior is also reinforced by examples in
examples.md:98-103andexamples.md:232-236. Although no malicious intent or credential-exfiltration endpoint was identified, the workflow creates an unsafe remote-publication path that exceeds the minimum privileges needed for code review.Attack Path
- A user invokes the Skill to review an Agent-owned pull request.
- A CI check reports a failure.
- Following the Skill instructions, the Agent changes source code or tests.
- The working tree also contains unrelated or sensitive uncommitted files.
- The Agent executes
git add ., staging all unignored changes rather than only the intended repair.
...[truncated 1019 chars]
- Remediation
View remediation
Remediation Suggestions
-
Make the default workflow review-only. Produce findings or a proposed patch rather than directly modifying the repository.
-
Require explicit user authorization before each consequential action:
- Editing files.
- Creating commits.
- Pushing to a remote repository.
-
Replace broad staging with an explicit allowlist:
bash git add -- path/to/intentionally-modified-file -
Require staged-diff validation before committing:
bash git diff --cached --name-status git diff --cached -
Run a secret scanner against staged content and abort if credentials, tokens, private keys, or sensitive configuration are detected.
-
Verify the target branch and remote with
git status,git branch --show-current, andgit remote -v. -
Never push automatically. Present the commit hash and proposed push command to the user unless remote publication was expressly authorized.
-
Update the corresponding examples in
examples.mdso they demonstrate scoped staging, approval gates, and staged-diff inspection.
-