Git命令行助手免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.3

Overview

This is mostly a Git command helper, but it includes broad activation rules and unsafe Git credential and push workflows that deserve review before installation.

Install only if you are comfortable supervising Git commands closely. Do not let it run bulk `git add .`, commits, pushes, force-like pushes, branch deletion, or global Git configuration without reviewing the exact files, diff, branch, and remote first. Avoid the suggested global plaintext credential helper; use an OS-backed credential manager or SSH key management instead.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:434

Finding

Global Plaintext Storage of Git Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:434
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: High

Vulnerable Code

bash

git config --global credential.helper store

Technical Analysis

The Skill recommends configuring Git's store credential helper globally. This helper persistently writes HTTPS credentials, including passwords or personal access tokens, to a local credential file without encryption.

Because the configuration uses --global, it affects all repositories and subsequent Git operations under the user's account rather than only the repository involved in the current task. Any process or user capable of reading the affected user's files may recover the stored credentials.

This contradicts the Skill's stated protection against sensitive-data exposure and expands the security consequences beyond a single Skill execution.

Attack Path

1. A user or agent executes the documented global configuration command.
2. The user authenticates to an HTTPS Git remote during a later pull, fetch, or push.
3. Git stores the supplied username and token or password unencrypted in the user's credential file.
4. Malware, a compromised development tool, an unauthorized local user, or an exposed backup reads the credential file.
5. The attacker extracts the credentials and authenticates to the associated Git service.
6. The attacker performs any repository or organization operation permitted by the credential's scopes.

Impact Assessment

Exploitation requires the ability to read files belonging to the affected local account or access an unprotected copy of those files. Successful exploitation exposes the full authority granted to the stored credential. Depending on token scopes, this may permit reading private source code, cloning repositories, modifying branches, pushing malicious commits, accessing package registries, or performing organization-level operations ...[truncated 200 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to use credential.helper store.

• Recommend Git Credential Manager or an operating-system-backed credential helper, such as macOS Keychain, Windows Credential Manager, or an appropriate Linux secret service.

• Alternatively, recommend SSH authentication with a passphrase-protected private key managed through ssh-agent.

• Avoid making global Git configuration changes automatically. Explain their scope and require explicit user confirmation.

• Use narrowly scoped, short-lived personal access tokens when HTTPS authentication is necessary.

• Document how to remove the insecure configuration and stored credentials:

  bash

  git config --global --unset credential.helper
  

• Instruct affected users to delete any plaintext credential file after migrating to a secure helper and revoke or rotate credentials that may have been exposed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:154

Finding

Unreviewed Bulk Staging Can Commit and Push Sensitive Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:154-161
Vulnerability Type: Unsafe bulk staging and remote publication workflow
Risk Level: Medium

Vulnerable Code

bash

# 3. 开发并提交
echo -e "\n3. 暂存并提交..."
git add .
git status
git commit -m "feat: 添加新功能"

# 4. 推送到远程
echo -e "\n4. 推送分支..."
git push -u origin feature/new-feature

Technical Analysis

The example workflow executes git add ., commits the staged content, and pushes the resulting commit to a remote repository. Although git status is executed, the workflow does not require user confirmation or inspect the staged content with git diff --staged before committing and transmitting it.

git add . recursively stages tracked and untracked files under the current working tree unless they are excluded by ignore rules. Sensitive files that are not covered by .gitignore—such as environment files, credentials, private keys, local configuration, database exports, debug logs, or generated artifacts—can therefore be included unintentionally.

The subsequent push changes the issue from local accidental inclusion to remote disclosure. Once sensitive material enters Git history, deleting the working-tree file or adding it to .gitignore does not remove it from existing commits.

Attack Path

1. A repository working tree contains a sensitive untracked or modified file that is not covered by an effective ignore rule.
2. The user asks the agent to perform the documented daily development workflow.
3. The agent runs git add ., staging the sensitive file together with intended changes.
4. The workflow displays status but does not require review or approval of the staged diff.
5. The agent creates a commit containing the sensitive material.
6. The agent pushes the branch to origin.
7. Users, automation, integrations, or attackers with access to the remote repository retrieve the secret from the branch or Git history.
8. If the ...[truncated 806 chars]

Remediation

View remediation

Remediation Suggestions

• Replace git add . with explicit path-based staging whenever possible:

  bash

  git add -- path/to/intended-file
  

• Require inspection of the exact staged changes before committing:

  bash

  git status --short
  git diff --staged
  

• Require explicit user approval after presenting the staged file list and diff, especially before commit and push operations.

• Run a secret scanner against staged content before committing, and stop the workflow if potential credentials or private keys are detected.

• Verify that repository-specific ignore rules cover environment files, private keys, local credentials, exports, and generated artifacts. Do not treat .gitignore as the sole security control.

• Separate staging, committing, and pushing into distinct confirmation boundaries rather than treating them as one automatic workflow.

• Before pushing, display the destination remote and branch and obtain explicit confirmation.

• If sensitive data has already been committed, revoke or rotate affected credentials first, then rewrite repository history where appropriate and coordinate removal from remote caches, forks, mirrors, and backups.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is extremely broad, covering generic coding, debugging, testing, and deployment situations rather than narrowly Git-specific requests. In an agent ecosystem this can cause the skill to activate on many unrelated prompts, exposing exec/write capabilities when they were not necessary.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This duplicate finding points to the same risky remote synchronization block. In the context of an agent skill with exec capability and vague routing, allowing direct push and history-altering operations without strong gating creates a real risk of unauthorized or accidental repository modification.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

git pull # 拉取并合并 git pull --rebase # 拉取并变基(推荐)

推送

git push # 推送当前分支 git push -u origin branch-name # 首次推送并设置跟踪 git push --force-with-lease # 安全强制推送

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This duplicate finding points to the same risky remote synchronization block. In the context of an agent skill with exec capability and vague routing, allowing direct push and history-altering operations without strong gating creates a real risk of unauthorized or accidental repository modification.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

git pull # 拉取并合并 git pull --rebase # 拉取并变基(推荐)

推送

git push # 推送当前分支 git push -u origin branch-name # 首次推送并设置跟踪 git push --force-with-lease # 安全强制推送

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

echo -e "\n撤销已推送提交(安全方式):" echo " git revert # 创建反向提交" echo " git push origin # 推送撤销" echo -e "\n注意:避免使用 git reset --hard 和 git push --force"

text

## 不适用场景

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation condition remains ambiguous and broad in the usage section, again tying the skill to general software-assistance tasks. Because the skill has exec/read/write tools, ambiguous routing materially increases the risk of unnecessary command execution in unrelated contexts.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

venv/

环境

.env .env.local

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

环境

.env .env.local

text

## 优选实践

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description explicitly states '支持中文交互', presenting a language constraint in the skill’s natural-language policy surface without indicating user choice or opt-in. Under the policy, forcing a specific language or locale without user selection is a violation unless clearly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document says operations follow a 'safety-first' principle, but later includes commands such as amend, rebase, and force-with-lease that can rewrite history or alter remote state. That mismatch is dangerous because users and agents may rely on the safety claim and execute impactful Git operations without sufficient confirmation or guardrails.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a narrow Git CLI helper, but the final '核心功能' section broadens it to generic file processing, external API calls, and information retrieval. This scope expansion can cause an agent or operator to over-trust the skill and permit actions outside its declared purpose, increasing the chance of unintended command execution or data handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Claiming 'API集成' for a local Git helper creates misleading expectations that the skill may call external services, despite no clear need in the stated use case. In agent environments, this kind of undocumented scope inflation can lead to unnecessary outbound data exposure or unsafe tool routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.