Code Analysis Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.1

Overview

This Git history analysis skill is not overtly malicious, but it gives inconsistent privacy claims while handling sensitive repository and author data.

Review before installing on confidential repositories. Use it only in a controlled environment, pin and verify dependencies yourself, confirm whether your agent's LLM sends repository content or metadata to an external provider, and avoid broad multi-repo scans unless consent, retention, and anonymization controls are clearly enforced.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:397

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 397–405
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

| gitpython | Python 库 | 必需 | `pip install gitpython` |
| pydriller | Python 库 | 必需 | `pip install pydriller` |
| radon | Python 库 | 必需 | `pip install radon` |
| tabulate | Python 库 | 必需 | `pip install tabulate` |
| jinja2 | Python 库 | 必需 | `pip install jinja2` |
| click | Python 库 | 必需 | `pip install click` |
| reportlab | Python 库 | PDF 必需 | `pip install reportlab` |
| weasyprint(可选) | Python 库 | PDF 推荐 | `pip install weasyprint` |
| concurrent-futures | Python 标准库 | 批量扫描 | Python 自带 |

Technical Analysis

The skill instructs users or agents to install several packages by name without exact versions, cryptographic hashes, a lockfile, or a trusted package-index configuration. Consequently, each installation resolves to whichever compatible release and transitive dependency set the configured Python index provides at installation time.

This mutable dependency resolution weakens build reproducibility and exposes the installation process to package-registry compromise, malicious upstream releases, compromised transitive dependencies, or unsafe index configuration. Python packages can execute attacker-controlled behavior during installation, build processing, or subsequent import and use.

The project does not include the advertised src.main implementation, so the necessity, compatibility, and safe use of these dependencies cannot be verified from the supplied artifact.

Attack Path

1. A user or AI agent follows the dependency instructions in SKILL.md.
2. It runs one or more unpinned commands, such as pip install pydriller.
3. pip resolves the package and its transitive dependencies through the environment's configured index.
4. A compromised package release, dependency, registry account, mirror, or index configuration supplies malicious package cont ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version.

2. Generate and ship a lockfile that also fixes all transitive dependency versions.

3. Record cryptographic hashes and install with hash verification, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Perform installation inside a dedicated, least-privileged virtual environment rather than a global or privileged Python environment.

5. Configure and document a trusted package index; do not silently inherit arbitrary extra-index or mirror settings.

6. Review dependency provenance and vulnerability status before publishing updates.

7. Bundle the intended src.main implementation so auditors can verify why each dependency is required and how it is used.

8. Add automated dependency integrity and vulnerability checks to the release process.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims it runs fully locally and does not transmit data externally, but elsewhere documents a required LLM API and network/LLM timeout conditions. This creates a trust-boundary mismatch: users may provide sensitive repository history or author data believing it stays local when the agent platform may actually send content to an external model service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly denies any need for external API keys or external transmission while simultaneously listing an LLM API as required and mentioning network-related failure modes. Such contradictory privacy/security claims can mislead users and organizations into approving use on confidential repositories under false assumptions about data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The visible skill name and summary are presented only in Chinese, and the rest of the document continues in Chinese without indicating that users may choose another language. This creates a locale/language constraint in the skill's natural-language interface that is not documented as region-specific or optional.

Content

No source excerpt is available for this finding.