ClawHub
Back to skill

Security audit

Git Cli Paid

Security checks across malware telemetry and agentic risk

Overview

This Git automation skill is mostly purpose-aligned, but it asks for broad command/file authority and normalizes multi-repository sync, cleanup, auto-push, and persistent credential setup without tight scoping or clear per-action user control.

Install only if you want an agent to help with Git automation using read, write, and shell execution. Before using it, require explicit confirmation for push, cleanup, branch deletion, tagging, credential changes, and any multi-repository operation; prefer dry runs and avoid global credential storage unless you understand the impact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill claims automated scripts are safety-first and will not perform risky Git actions, but elsewhere enables auto-push, auto-cleanup, sync, and batch cleanup workflows. This mismatch can cause users or agents to trust the skill more than warranted, leading to unintended repository-changing operations across one or many repos without adequate confirmation.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
Although presented as a Git assistant, the skill advertises generic file handling, API integration, command execution, and information retrieval capabilities. This scope expansion increases the chance an agent will apply the skill outside its expected trust boundary, exposing local files, executing broader commands, or interacting with external services in ways the user did not intend.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation/use description is overly broad, encouraging use whenever efficiency, automation, batch processing, or workflow optimization are desired. Ambiguous activation criteria make accidental invocation more likely in contexts involving write/exec tools, which can lead to unintended repository or filesystem changes without sufficiently specific user authorization.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples show batch sync and cleanup across multiple repositories without prominent user-facing warnings about repository-changing effects. In a skill with exec/write capabilities, normalizing these operations without confirmation can lead to mass pushes, branch changes, or cleanup-related data loss at scale if an agent follows the examples automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.