Git Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This Git helper is not deceptive, but it gives an agent powerful repository-changing commands and unsafe global credential guidance without enough safeguards.

Review before installing. Use this only when you are comfortable with an agent running Git commands in your repositories. Require the agent to show the current repo, branch, git status, and planned changes before any reset, restore, rebase, push, branch deletion, or global git config change. Avoid credential.helper store; prefer an OS-backed credential manager or SSH-agent workflow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:484

Finding

Global Configuration Enables Plaintext Git Credential Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:484
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Complete Code Snippet:

bash

# HTTPS authentication
git config --global credential.helper store

Technical Analysis

The skill recommends configuring Git's store credential helper globally. This helper persistently saves HTTPS credentials without encryption, typically in a user-readable plaintext credentials file. Because the command uses --global, the insecure behavior applies to the user's Git environment rather than only to the repository involved in the current task.

Although file permissions may limit access, this mechanism does not provide encryption or protection against processes running under the same account, local compromise, accidental backup exposure, or unauthorized access to the user's files.

Attack Path

1. A user or agent follows the skill and executes:

   bash

   git config --global credential.helper store
   

2. The user subsequently authenticates to an HTTPS Git remote.
3. Git persistently writes the supplied username and reusable password or access token to its credentials file without encryption.
4. A malicious process, compromised development tool, or unauthorized user with access to the account's files reads the stored credential.
5. The attacker reuses the credential against the associated Git hosting service, subject to the token's validity and permissions.

Impact Assessment

Exposure can grant the attacker the same repository privileges as the compromised credential. Depending on its scope, this may include reading private source code, cloning repositories, pushing unauthorized changes, modifying branches, or accessing multiple repositories associated with the account.

This instruction does not itself elevate operating-system privileges. The ultimate scope is constrained by local file access, credential validity ...[truncated 83 chars]

Remediation

View remediation

Remediation Suggestions

• Remove git config --global credential.helper store from the recommended setup.
• Use Git Credential Manager or an operating-system-backed credential helper, such as macOS Keychain or Windows Credential Manager.
• Prefer short-lived, narrowly scoped access tokens over account passwords or broadly privileged tokens.
• Avoid changing global Git authentication settings automatically; require explicit informed consent and prefer repository-scoped configuration where feasible.
• If plaintext storage must remain documented as an exceptional option, clearly state that credentials are stored unencrypted and provide instructions for removing both the configuration and previously stored credentials.
• Rotate any credential that may already have been stored insecurely and review its repository access logs for unauthorized use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

git reset --hard HEAD~1 is a destructive command that permanently discards local changes and rewrites branch state, making it dangerous when exposed through a general-purpose exec-enabled skill. If triggered with insufficient confirmation or in the wrong repository/branch, it can cause immediate data loss.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

git diff --stat HEAD~5                     # 最近5个提交统计
# 恢复操作
git reset --soft HEAD~1                    # 撤销提交,保留变更
git reset --hard HEAD~1                    # 撤销提交,丢弃变更(危险)
git restore file.txt                       # 丢弃工作区变更
git restore --staged file.txt              # 取消暂存
# 查找丢失的提交

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The recovery example recommends git reset --hard <sha>, which can irreversibly discard work and move repository history to an arbitrary commit. In an agent context, presenting this as a straightforward recovery step without stronger safeguards can normalize a highly destructive action.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md

echo "1. 查看reset前的提交:"
git reflog | grep "reset"
echo "2. 恢复到该提交:"
echo "   git reset --hard <sha>"

# 4. 撤销已推送的提交(安全方式)
echo -e "\n撤销已推送的提交(使用revert):"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

4. 撤销已推送的提交(安全方式)

echo -e "\n撤销已推送的提交(使用revert):" echo " git revert " echo " git push origin main"

text

## 快速开始

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.

md

*.so

# 环境变量
.env
.env.local
.env.*.local

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md

# 环境变量
.env
.env.local
.env.*.local

# IDE

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This FAQ explicitly suggests git reset --hard HEAD~1 as a way to discard all changes, which is dangerous in a skill that may be followed literally by an automated agent using exec. The context makes the risk higher because FAQs are often treated as quick, authoritative recipes and may be used without careful review.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

git reset HEAD~1

撤销提交,丢弃所有变更(危险!)

git reset --hard HEAD~1

text

### Q2:如何修改已推送的提交?

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section documents destructive recovery commands such as git reset --hard HEAD~1 and git restore file.txt but does not present a prominent safety warning that these commands can permanently discard local uncommitted changes or rewrite history. In an agent-executed skill, omission of strong guardrails materially raises the risk of accidental data loss.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "请帮我创建功能分支,提交代码并推送到远程。" is broad enough to overlap with normal development requests and can cause the skill to activate for high-impact Git actions without a narrowly scoped intent check. In a skill with exec access and push capability, ambiguous invocation increases the chance of unintended repository modification or data exfiltration to remotes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends git config --global credential.helper store, which persists Git credentials in plaintext or weakly protected local storage on many systems, without warning users of the security implications. This can expose repository credentials to other local users, malware, or forensic recovery.

Content

No source excerpt is available for this finding.