ClawHub
Back to skill

Security audit

Git Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This Git helper is mostly purpose-aligned, but it includes destructive repository changes, remote branch deletion, broad push workflows, and persistent credential/global configuration steps without clear confirmation safeguards.

Install only if you are comfortable letting the agent run Git commands that can change local history, push to remotes, delete remote branches, and alter global Git authentication/configuration. Before use, require the agent to show the exact repo, branch, files, remote, and command, and do not allow credential.helper store or hard reset unless you explicitly requested them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill metadata advertises a narrowly scoped Git toolkit, but the body also instructs remote pushes, remote branch deletion, and global Git credential/config changes. This scope mismatch can cause an agent or user to invoke repository-impacting or host-wide actions they would not reasonably expect from the description, increasing the chance of unsafe execution.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The skill includes credential helper configuration and SSH key generation guidance, which expands it from routine version-control help into authentication setup. In an agent context with exec access, this broadens the attack surface around secrets and trust material beyond what users may expect from a basic Git workflow skill.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The document claims the agent will automatically prevent dangerous operations, yet elsewhere it provides destructive commands such as hard reset, force-like history rewrites, and remote deletion. This contradiction can create false trust and lead users to approve actions under the mistaken belief that safeguards are enforced when the file defines no actual enforcement mechanism.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase asks the agent to create a branch, commit code, and push to a remote using broad natural language rather than a tightly scoped invocation. In a skill with exec permissions, such generic matching can cause unintended activation and immediate execution of multi-step repository-modifying actions without sufficient parameter validation or staged confirmation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This section documents destructive recovery commands including `git reset --hard HEAD~1`, which can irreversibly discard local changes, but the warning is minimal and not paired with enforced safeguards. In an agent-executed workflow, users may trigger data-loss operations through ordinary prompts and lose uncommitted work or local history unexpectedly.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The workflow includes repository-impacting actions such as pushing to a remote and deleting a remote branch without an up-front warning or confirmation model. These commands can alter shared history or remove collaboration artifacts, making accidental invocation more dangerous in a tool-enabled agent than in static documentation alone.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git diff --stat HEAD~5                     # 最近5个提交统计
# 恢复操作
git reset --soft HEAD~1                    # 撤销提交,保留变更
git reset --hard HEAD~1                    # 撤销提交,丢弃变更(危险)
git restore file.txt                       # 丢弃工作区变更
git restore --staged file.txt              # 取消暂存
# 查找丢失的提交
Confidence
94% confidence
Finding
git reset --hard

Tool Parameter Abuse

High
Category
Tool Misuse
Content
echo "1. 查看reset前的提交:"
git reflog | grep "reset"
echo "2. 恢复到该提交:"
echo "   git reset --hard <sha>"

# 4. 撤销已推送的提交(安全方式)
echo -e "\n撤销已推送的提交(使用revert):"
Confidence
93% confidence
Finding
git reset --hard

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.