ClawHub
Back to skill

Security audit

Git Essentials Tool Free

Security checks across malware telemetry and agentic risk

Overview

This Git helper is mostly coherent, but it gives an agent broad shell-based Git authority with under-scoped destructive, remote-changing, and credential-persistence examples.

Install only if you want an agent to run Git commands for you. Before using it, require the agent to show git status, current branch, remote URL, and a preview for cleanup commands, and give explicit approval before push, pull --rebase, reset --hard, branch/tag deletion, credential changes, or any git clean command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger conditions are overly broad ('code generation, programming assistance, debugging, deployment'), which can cause this skill to activate for many generic developer prompts unrelated to Git. In an agent context with exec permission, over-triggering increases the chance of unnecessary shell execution and accidental repository-impacting commands being suggested or run in the wrong context.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This section documents operations that can alter local data or remote repository state, including pull/rebase, push, and force-with-lease, but provides no explicit safety guidance or confirmation requirement. In a tool-using agent, omission of warnings makes accidental destructive actions more likely, especially when commands affect shared branches or remote repos.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git clean -n                             # 预览
git clean -f                             # 清理未跟踪文件
git clean -fd                            # 清理目录
git clean -fdx                           # 清理包括gitignore

# 变基
git rebase main                          # 变基到main
Confidence
96% confidence
Finding
git clean -fdx

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.