Git基础工具免费版

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:47 AM UTC
• Version: 1.0.2

Overview

This Git helper is mostly a normal command-reference skill, but it gives an agent broad execution authority and includes risky Git and credential-storage guidance without enough scoping or confirmation safeguards.

Install only if you want an agent to run Git commands in your repositories. Before use, require the agent to show git status/diff and ask for explicit confirmation before any reset, clean, force push, branch or tag deletion, remote deletion, or credential change. Prefer secure OS credential managers or SSH keys instead of credential.helper store.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a Git essentials tool, but its documented 'core functions' expand into generic file handling, external API integration, and command execution. That scope expansion increases the chance an agent will invoke broader capabilities than a user expects, enabling unintended access to files or network-connected actions under the cover of a benign Git workflow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Advertising external API integration in a Git-focused skill is unjustified by the stated purpose and broadens the trust boundary unnecessarily. Even without embedded exploit code, this can cause an agent to make outbound requests or handle external data in contexts where users only expected local version-control assistance.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The safety section warns against interpolating user input into shell commands, yet the examples elsewhere read user-supplied values such as remote URLs and pass them directly into git commands. This inconsistency normalizes unsafe command-construction patterns and can lead downstream agents or users to build shell commands with untrusted input.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The top-level description says to use this skill for broad categories like code generation, programming assistance, debugging, testing, and deployment, far beyond Git basics. Overbroad activation criteria make accidental invocation likely, giving a tool-enabled skill access in situations unrelated to version control and increasing the chance of unsafe command execution.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger section repeats broad, ambiguous conditions and does not define strict boundaries for when the skill should or should not run. In an agent ecosystem, that ambiguity can cause this exec-capable skill to be selected for generic development requests, increasing exposure to unnecessary file and shell operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents destructive commands such as 'git reset --hard HEAD~1' and restore operations that can permanently discard local work, but it does not provide strong warnings, confirmation requirements, or recovery guidance adjacent to those commands. In an automated agent context, presenting such commands without safeguards materially increases the risk of irreversible data loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes high-risk cleanup and deletion commands, including branch deletion, remote tag deletion, and 'git clean -fdx', without sufficient warnings about irreversible removal of local or remote data. In a tool-using agent, such commands can be executed quickly and at scale, magnifying the impact of a mistaken invocation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The authentication guidance recommends 'git config --global credential.helper store', which persists credentials in plaintext or weakly protected local storage on many systems, and it does so without warning about the security implications. This can expose repository credentials to other local users, malware, backups, or accidental disclosure.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git clean -n                             # 预览
git clean -f                             # 清理未跟踪文件
git clean -fd                            # 清理目录
git clean -fdx                           # 清理包括gitignore
# 变基
git rebase main                          # 变基到main
git rebase -i HEAD~3                     # 交互式变基

• Confidence: 95% confidence
• Finding: The skill exposes 'git clean -fdx', a highly destructive command that removes untracked files, directories, and ignored files, which can wipe build artifacts, local configs, or untracked work. In an exec-enabled skill with broad triggers, this becomes especially dangerous because an agent may run it in the wrong repository or without the user's full understanding of the consequences.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.