Security audit

Git辅助

Security checks for vulnerabilities and agentic risk

Overview

This Git helper is not clearly malicious, but it asks for command/write authority while its instructions are broad, inconsistent, and under-scoped.

Review before installing. Use only in repositories where command execution and Git mutation are acceptable, and require explicit confirmation for pull, push, branch changes, resets, or file writes. Do not rely on the claimed sandbox or whitelist unless your host platform separately enforces those controls.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims command execution is limited to a whitelist and safe sandbox, but the document provides no enforceable mechanism, policy, or implementation detail that would actually constrain exec behavior. In a skill that exposes read/write/exec capabilities, unsupported safety claims can mislead operators into trusting destructive or arbitrary command execution paths that are not actually restricted.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The skill is presented as a Git helper, but significant portions describe unrelated code review, vulnerability scanning, CI/CD, and scoring features. This scope confusion can cause an agent or user to invoke the skill in broader contexts than intended, increasing the chance that exec/write capabilities are used on sensitive repositories or workflows under false assumptions about what the skill actually does.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documented output schema describes code-review scoring data rather than Git operation results, directly conflicting with the stated Git-helper purpose. This inconsistency can lead downstream agents to parse and trust fabricated or misclassified outputs, causing unsafe automation decisions such as assuming security checks or repository validations occurred when they did not.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The FAQ states the skill performs automatic code analysis and review report generation, which expands the apparent authority of the skill beyond Git operations. In an agent ecosystem, misleading capability claims are dangerous because they can cause improper trust decisions, broader data exposure, or execution in contexts that require specialized safeguards not described here.

Vague Triggers

High

Confidence: 91% confidence
Finding: The invocation guidance is overly broad and mismatched, suggesting use for system monitoring, log analysis, alerting, and deployment management despite the skill being a Git helper. Overbroad triggers increase the likelihood an agent will select this skill in inappropriate contexts, where its exec/write permissions could affect non-Git systems or sensitive operational environments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises read/write/exec capabilities without prominently warning that these operations can modify repositories, alter files, or affect the host environment. Lack of clear safety warnings is dangerous in a command-capable skill because users and agents may treat it as informational while it can actually perform irreversible actions such as branch changes, pushes, or file writes.

Static analysis

No suspicious patterns detected.