T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:72
- Finding
- Unscoped Git Staging and Autonomous Repository Commits## Vulnerability Details **File Location**: `SKILL.md`, lines 67–83 and line 130 **Vulnerability Type**: Unsafe repository modification and unscoped Git staging **Risk Level**: Medium ### Vulnerable Code Lines 72 and 83 require staging every change in the repository before committing: ```bash git add -A && git commit -m "vibe: [dimension] fix [subproblem] — summary" ``` ```bash git add -A && git commit -m "vibe: [dimension] improve from X to Y — summary" ``` Line 130 additionally instructs the agent to execute the workflow directly without asking whether it should continue, except when it encounters an ambiguity that it cannot resolve. ### Technical Analysis The `git add -A` command stages all non-ignored changes visible to Git across the working tree. Its scope is not restricted to files modified by the Skill. Consequently, unrelated tracked-file modifications, deletions, and non-ignored untracked files already present in the repository can be included in the mandatory commits. The workflow does not require inspection of `git status`, review of the staged diff, secret scanning of staged content, or user approval before committing. The instruction to continue autonomously compounds this issue because the user may not receive an opportunity to detect or exclude unrelated content before it becomes part of Git history. This is an insecure coding practice rather than a privilege-escalation flaw. The Skill operates with the agent's existing repository and Git permissions; it does not obtain additional system privileges. ### Attack Path 1. A repository contains an unrelated modified file or a non-ignored untracked file. This could include local configuration, credentials, API tokens, private notes, or unfinished user work. 2. The user invokes the Skill to assess and improve the project. 3. The Skill modifies files while following its scorecard workflow. 4. The mandated `git add -A` command stages bot ...[truncated 1124 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `git add -A` with explicit staging of only the files intentionally modified by the current remediation task: ```bash git add -- path/to/modified-file path/to/test-file ``` 2. Capture the initial repository state with `git status --short` before making changes. Treat all pre-existing modifications and untracked files as out of scope. 3. Before each commit, require these checks: ```bash git status --short git diff --cached --stat git diff --cached ``` 4. Unstage any file not explicitly associated with the current subproblem: ```bash git restore --staged -- path/to/unrelated-file ``` 5. Run secret detection against the staged diff before committing, and block commits containing credentials, private keys, tokens, or sensitive configuration. 6. Do not automatically commit when the working tree was already dirty. Either preserve and exclude pre-existing changes reliably or request user confirmation. 7. Revise the autonomous-execution instruction so that repository commits require explicit approval, especially when staged files include content not created or modified by the Skill. 8. Document every file included in a commit and verify that the commit contains changes for only one intended subproblem.