ClawHub
Back to skill

Security audit

Git基础工具专业版

Security checks for vulnerabilities and agentic risk

Overview

This Git skill is mostly purpose-aligned, but it includes high-impact repository rewrite and credential-storage guidance without enough safeguards.

Install only if you want an agent to help with advanced Git operations and you are prepared to review every command before execution. Avoid using the plaintext credential-store advice; prefer SSH keys or an OS-backed credential manager. For history rewrites, force pushes, submodule deletion, and garbage collection, work from a backup or mirror clone and coordinate with collaborators first.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill gives contradictory guidance about API key requirements, saying both that no extra API key is needed and that some features require API keys. This can mislead users into misconfiguring authentication, storing secrets unnecessarily, or trusting undocumented external calls, which is especially risky in a skill that advertises command execution and API integration.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The document claims user input is not concatenated into command parameters, yet it defines free-form text input and repeatedly presents shell/Git command execution patterns. This mismatch creates a false sense of safety and increases the chance that downstream implementations will pass untrusted input into Bash or Git commands without proper validation.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill is presented as a Git-focused tool but also claims generic API integration and network communication capabilities outside that scope. Scope expansion beyond the stated purpose weakens least-privilege expectations and may enable unexpected external data flows or command paths that users did not consent to.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger description is broad enough to match many common development requests, increasing the likelihood that the skill will activate in contexts not intended by the user. Because the skill includes destructive Git operations and Bash execution, over-triggering materially raises misuse risk.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill documents destructive history-rewrite commands such as filter-branch, filter-repo, reflog expiry, and aggressive garbage collection without prominent warnings about irreversibility, backups, collaborator impact, or remote force-push consequences. In a Git automation context, that omission makes accidental repository damage and loss of recoverability far more likely.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation recommends `git config --global credential.helper store` without warning that it stores credentials in plaintext on disk. That guidance can directly expose repository credentials to local compromise, backups, or other users on shared systems.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git submodule foreach 'git checkout main'
# ...
git submodule deinit -f libs/lib
git rm -f libs/lib
rm -rf .git/modules/libs/lib
# ...
git submodule status
Confidence
92% confidence
Finding
The skill includes forceful removal commands for submodules and repository paths, including `git rm -f`, in a broadly callable automation tool. Without strict path validation, contextual confirmation, and repository-bound safety checks, destructive file operations can cause unintended data loss or be repurposed in unsafe implementations.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# ...
git submodule deinit -f libs/lib
git rm -f libs/lib
rm -rf .git/modules/libs/lib
# ...
git submodule status
git submodule summary
Confidence
95% confidence
Finding
The documented `rm -rf .git/modules/libs/lib` is a destructive recursive delete inside Git metadata. In an agent skill with Bash capability, normalizing this pattern without strong guardrails increases the risk of metadata corruption, broken repositories, or unsafe adaptation to user-controlled paths.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git filter-repo --path credentials.json --invert-paths
# ...
echo "需要强制推送,请确认:"
echo "  git push --force-with-lease origin --all"
echo "  git push --force-with-lease origin --tags"
# ...
rm -rf .git/refs/original/
Confidence
94% confidence
Finding
The skill instructs force-pushing rewritten history with `--force-with-lease` for all branches and tags after secret-removal. Even though this is sometimes operationally necessary, presenting it without strong safeguards in an automation-oriented skill can overwrite remote history, disrupt collaborators, and amplify mistakes across the entire repository.

Static analysis

No suspicious patterns detected.