Back to skill

Security audit

Git助手免费版

Security checks across malware telemetry and agentic risk

Overview

This Git helper is mostly aligned with Git workflows, but it includes under-disclosed credential persistence, broad execution scope, and risky destructive Git examples that users should review before installing.

Review this skill carefully before installing. Use it only for explicit Git tasks, avoid enabling `credential.helper store` unless you accept plaintext credential storage, back up or inspect files before running generated overwrite commands, and treat any `git reset --hard` guidance as destructive unless you have confirmed the repository state and saved important work.

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill says no extra API key is needed, but then instructs users to enable `git config --global credential.helper store`, which persists repository credentials in plaintext on disk. This can expose tokens or passwords to other local users, malware, backups, or accidental disclosure, especially in shared or managed environments.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill is presented as a Git helper, but the documentation later claims broader capabilities including file handling, API integration, and command execution. This scope expansion increases the chance an agent may invoke the skill in contexts beyond simple Git guidance, creating unnecessary access to sensitive files or external services.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Claiming external API integration in a Git-assistance skill introduces unnecessary network-capable behavior that is not required for the stated purpose. Unneeded external communications increase the attack surface for data exfiltration, prompt abuse, or unauthorized transmission of repository metadata.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
Advertising file write support goes beyond a guidance-oriented Git helper and may encourage an agent to modify repository files or local configuration without clear user intent. In the context of a tool with `exec` access, this broadens the risk of unintended changes, destructive edits, or persistence of unsafe settings.

Vague Triggers

High
Confidence
92% confidence
Finding
The trigger description says to use the skill for broad tasks such as code generation, programming assistance, debugging, testing, and deployment, far beyond Git help. Overbroad invocation criteria can cause an agent to route unrelated requests into a skill that has `exec` capability, increasing the chance of unsafe command execution in unintended contexts.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger conditions are vague and do not provide concrete constraints on when the skill should or should not run. Ambiguous activation rules can lead to accidental invocation in unrelated tasks, which is more dangerous here because the skill is allowed to execute shell commands.

Missing User Warnings

High
Confidence
98% confidence
Finding
The documentation includes a credential storage command without warning that it stores credentials insecurely in plaintext. Users may follow the instruction as a recommended default, leading to compromise of repository credentials through local access, malware, backups, or accidental file disclosure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented `generate_gitignore()` function uses `cat > .gitignore`, which silently overwrites any existing `.gitignore` file. In a developer helper skill, this can remove previously curated ignore rules and indirectly expose sensitive or build-related files to future commits if users assume the operation is additive or safe.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
2)
        echo "撤销提交,丢弃变更..."
        read -p "确认丢弃所有变更? (y/N) " confirm
        [ "$confirm" = "y" ] && git reset --hard HEAD~1
        ;;
    3)
        echo "查找误删除的分支..."
Confidence
87% confidence
Finding
The recovery script includes `git reset --hard HEAD~1`, a destructive command that permanently discards uncommitted changes and rewrites local history. Although the script asks for confirmation, the skill targets routine developer use, so presenting a hazardous command in an interactive helper increases the chance of accidental data loss.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
4)
        echo "查找误reset的提交..."
        git reflog | grep "reset"
        echo "找到SHA后: git reset --hard <sha>"
        ;;
    5)
        echo "撤销已推送的提交(安全方式)..."
Confidence
84% confidence
Finding
The documentation instructs users to run `git reset --hard <sha>` when recovering from a mistaken reset. While valid in some recovery workflows, this is a high-risk command because an incorrect SHA or misunderstanding of current state can destroy working tree changes and move branch history unexpectedly.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.