Git命令行

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

This Git helper is not malicious, but it gives an agent broad repository-changing authority and includes risky Git commands as normal guidance.

Install only if you want an agent to help operate Git in your repositories, and keep user confirmation required for commits, branch deletion, resets, rebases, force pushes, tag pushes, and any push to main or shared branches. Review diffs yourself before allowing write or remote operations, and avoid providing API keys unless the publisher explains exactly what service is used and what repository data may leave your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This duplicate finding points to the same risky push guidance, including force-with-lease to main. The danger is heightened by the skill context: it advertises automation and execution, so these commands are not merely educational text but plausible agent actions affecting shared infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

git fetch origin
git fetch --all --prune  # 获取所有远程并清理已删除的分支
# 推送
git push origin feature/branch
git push -u origin feature/branch  # 设置上游跟踪
git push --force-with-lease origin main  # 安全强制推送（推荐）
# 注意：避免使用 git push --force，它会覆盖远程历史

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This duplicate finding points to the same risky push guidance, including force-with-lease to main. The danger is heightened by the skill context: it advertises automation and execution, so these commands are not merely educational text but plausible agent actions affecting shared infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

git fetch origin
git fetch --all --prune  # 获取所有远程并清理已删除的分支
# 推送
git push origin feature/branch
git push -u origin feature/branch  # 设置上游跟踪
git push --force-with-lease origin main  # 安全强制推送(推荐)
# 注意:避免使用 git push --force,它会覆盖远程历史

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documents destructive recovery behavior using git reset --hard HEAD~1, which permanently discards local changes, but does not present strong warnings, prerequisites, or safer alternatives in the same workflow. In an agent setting, this can directly cause irreversible data loss if suggested or executed automatically.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

git reset --hard is a destructive command that discards uncommitted work and can be catastrophic if run on the wrong repository or branch. In an agent-executed context, exposing this as routine guidance without strong interlocks materially increases the risk of accidental data loss.

Content

Scanner excerpt · SKILL.md (reported line 445)May include surrounding context.

md

| 完成合并 | git commit |

### Q5: 如何在Git CLI中回退到上一个提交？
A: 使用 `git reset --hard HEAD~1` 命令可以回退到上一个提交。

| 命令 | 操作 |
|:-----|:-----|

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The FAQ explicitly normalizes git reset --hard HEAD~1 while noting that changes are lost, but it still presents the command as a standard answer instead of a last-resort action. This increases the likelihood that users or automation invoke an irreversible destructive command inappropriately.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md

| 命令 | 操作 |
|:-----|:-----|
| git reset --hard HEAD~1 | 回退到上一个提交，丢失当前提交后的所有更改 |
## 主要特点
- **自动化执行**: 用Git CLI检查/暂存/提交/分支/同步代码变更。Helper for using the Git CLI to i
- **文件处理**: 支持多种文件格式的读取、解析和写入操作

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is overly broad, covering general coding, debugging, deployment, and automation scenarios rather than narrowly scoping Git tasks. Over-broad activation increases the chance the skill is invoked in contexts where repository mutation, credential use, or command execution is unnecessary or unsafe.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description states 支持中文交互 in a way that presents Chinese interaction as a fixed behavior, and the file title/display name is also localized without offering a language choice. This can violate language/locale policy expectations when users have not explicitly opted into Chinese.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a Git CLI helper, but its runtime section introduces a required LLM API and generic API-style capability that expands the effective trust boundary beyond local Git operations. This can mislead users and agents about what external services may be involved, increasing risk of unintended data exposure from repository contents, prompts, or metadata.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document claims that only whitelisted commands are executed, but elsewhere it describes broad command execution behavior without defining or enforcing an actual whitelist. This creates a false sense of safety and may cause users or orchestrators to permit execution under weaker controls than the skill really deserves.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.