ClawHub
Back to skill

Security audit

Git基础工具免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a Git helper skill, but it gives an agent broad command authority with destructive Git, remote push, and plaintext credential-storage guidance that needs review before use.

Install only if you want an agent to help run Git commands and you are prepared to review every command before execution. Require confirmation before push, force-push, reset, restore, clean, branch deletion, or remote URL changes. Avoid `credential.helper store`; prefer an OS-backed credential manager or SSH agent, and verify the repository, branch, and remote URL before allowing the skill to act.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:430
Finding

Global Plaintext Storage of Git Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 430
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code:

bash
# HTTPS
git config --global credential.helper store

Technical Analysis

The skill recommends globally enabling Git's store credential helper. This helper persists HTTPS credentials without encryption, typically in the user's ~/.git-credentials file. Depending on the remote service and authentication flow, the stored value may contain a repository password or personal access token.

Because the setting is global, it affects subsequent Git operations across all repositories for that operating-system account, not only the repository associated with the current skill invocation. Any local process or user capable of reading the account's credential file could recover and reuse the stored secret.

Attack Path

  1. A user follows the documented command and enables the global store credential helper.
  2. The user authenticates to an HTTPS Git remote with a password or access token.
  3. Git writes the credential to the user's credential file without encryption.
  4. A malicious process, compromised development tool, or local principal with access to the user's files reads the credential.
  5. The attacker reuses the credential against the Git hosting service, subject to the token's validity and granted permissions.

Impact Assessment

Successful exploitation can disclose Git hosting credentials and permit unauthorized actions available to the compromised account or token. Depending on the credential's scope, this may include reading private repositories, cloning proprietary source code, pushing unauthorized changes, modifying repository content, or accessing other resources authorized by the same token.

The issue does not itself grant elevated operating-system privileges. Its scope is bounded by local access to the credential file and by ...[truncated 56 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to use credential.helper store.
  • Prefer an operating-system-backed credential manager, such as Git Credential Manager, macOS Keychain, or an appropriate Linux secret service.
  • Alternatively, recommend SSH authentication with a passphrase-protected key managed by an SSH agent.
  • Use repository-specific configuration where practical rather than changing global authentication behavior.
  • Apply least privilege and expiration to personal access tokens.
  • Warn users that Git's store helper saves credentials unencrypted if it must be documented for compatibility reasons.
  • Advise affected users to disable the helper, remove exposed entries from ~/.git-credentials, and rotate any credentials that were stored there.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill exposes direct push and force-push workflows through exec-capable automation without requiring confirmation or guardrails. In context, this can alter remote repositories, overwrite shared history, or leak private code to attacker-controlled remotes if the destination is user-supplied or mistaken.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

git fetch origin # 获取不合并 git pull # 拉取并合并 git pull --rebase # 拉取并变基 git push # 推送 git push -u origin branch-name # 首次推送 git push --force-with-lease # 安全强制推送

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

git reset --hard is a destructive command that permanently discards local changes and can be catastrophic if run automatically or on the wrong branch. In a tool-using agent, documenting it without strong safeguards makes accidental data destruction much more likely.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

git reset HEAD file.txt # 取消暂存(旧)

提交

git reset --soft HEAD1 # 撤销提交,保留变更 git reset --hard HEAD1 # 撤销提交,丢弃变更 git revert commit-hash # 创建反向提交

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
# 2. 创建.gitignore
cat > .gitignore << 'EOF'
node_modules/
.env
*.log
dist/
.vscode/

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

git clean -fdx removes untracked files, directories, and even files ignored by .gitignore, which can destroy local build artifacts, configs, or sensitive work not committed to Git. In an automated exec context, this is a high-risk destructive operation if invoked without preview and confirmation.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md
git clean -n                             # 预览
git clean -f                             # 清理未跟踪文件
git clean -fd                            # 清理目录
git clean -fdx                           # 清理包括gitignore
# 变基
git rebase main                          # 变基到main
git rebase -i HEAD~3                     # 交互式变基

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This example combines git reset --hard with push --force-with-lease to rewrite published history, creating both local data loss and remote integrity risks. In shared repositories, accidental execution can disrupt collaborators and permanently remove expected history from the remote branch.

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

git push

不安全方式(仅未共享分支)

git reset --hard HEAD~1 git push --force-with-lease

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is extremely broad, covering general coding, debugging, testing, and deployment scenarios, which makes accidental invocation likely. In a skill with exec and write capabilities, overbroad activation increases the chance that the agent uses powerful Git and shell operations in contexts the user did not specifically intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The remote sync and credential storage guidance encourages operations that contact external repositories and later recommends credential.helper store, but it does not foreground privacy, persistence, and credential exposure risks. In an exec-capable agent, this can lead users to send code to unintended remotes or store credentials insecurely on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents destructive commands such as git restore ., git reset --hard HEAD~1, and similar recovery operations without prominent warnings or confirmation requirements. In an agent context, these commands can irreversibly delete local work or rewrite history, causing material data loss if executed on the wrong repository or branch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation conditions are vague and not specific enough to distinguish ordinary software-assistance requests from requests that truly need this exec-capable Git skill. Ambiguous routing makes unsafe tool use more likely, especially when destructive Git commands are also documented.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill’s safety guidance says not to concatenate user input into command-line parameters, yet its examples directly read a user-supplied remote URL and pass it into git remote add. In an agent with exec capability, unvalidated user-controlled command parameters can lead to unsafe command execution patterns, unexpected network destinations, or abuse of protocol handlers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description and summary frame this as a beginner-oriented Git essentials tool focused on initialization, commits, branches, remotes, and history. However, the later '核心功能' section claims broader capabilities such as generic file processing, API integration, and system command execution, which materially exceeds a Git-essentials scope and is not supported as merely an implementation detail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

A beginner Git essentials skill does not obviously require calling external APIs as part of its stated purpose. The 'API集成' capability is unjustified by the manifest, which describes Git version-control operations rather than general remote service orchestration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description states '支持中文交互', and the document is framed around Chinese interaction without presenting it as an option or documenting a justified locale restriction. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.