Git工具包专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.1

Overview

The skill is a Git automation guide, but it gives risky credential and repository-changing instructions without enough safeguards.

Review before installing. Use this only in repositories where the agent is allowed to change Git configuration and branches. Do not follow the credential examples as written: avoid plaintext credential storage and token-in-URL remotes, and prefer SSH keys, an OS-backed credential manager, or protected CI secrets. Require human confirmation before branch deletion, hook installation, global Git config changes, or any `--no-verify` bypass.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:268

Finding

Insecure Plaintext Git Credential Storage and Token Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:268-270
Vulnerability Type: Plaintext credential storage and sensitive token exposure
Risk Level: High

bash

git config --global credential.helper store
# ...
git remote set-url origin https://<token>@git.example.com/repo.git

Technical Analysis

The documented configuration enables Git's store credential helper, which normally persists credentials unencrypted in a file such as ~/.git-credentials. It also instructs users to embed an access token directly in an HTTPS remote URL. Although the example uses a placeholder and does not identify a malicious server, a real token supplied in this position can be retained in .git/config, shell history, command logs, backups, diagnostic output, and configuration listings.

HTTPS protects the token while it is transmitted to the Git server, but it does not protect plaintext copies stored locally. This guidance also conflicts with the Skill's claims that credentials are securely configured and that sensitive information is not exposed.

The network operation is relevant to the Skill's remote repository functionality, but storing a reusable token in plaintext is not necessary for that functionality and exceeds minimum secure credential-handling requirements.

Attack Path

1. A user replaces the placeholder with a valid repository access token and runs the documented commands.
2. The token is persisted unencrypted by the Git credential helper and/or in the repository's remote URL.
3. A local process, another user with file access, a support bundle, a backup system, shell-history collection, or accidentally published configuration reads the token.
4. An attacker extracts and replays the token against the Git server.
5. The attacker performs any repository actions permitted by the token until it expires or is revoked.

Impact Assessment

Successful exploitation exposes the privileges assigned to the compromised token. Depending on its ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to use credential.helper store.
• Use an operating-system-backed credential manager, such as Git Credential Manager, macOS Keychain, Windows Credential Manager, or a properly configured secret service.
• Alternatively, use SSH authentication with an SSH agent and a protected private key.
• Configure the remote without embedded credentials, for example:

bash

git remote set-url origin https://git.example.com/repo.git

• For CI/CD, inject short-lived credentials through the platform's protected secret mechanism instead of writing them into repository configuration.
• Scope tokens to the minimum repository and operations required, assign short expiration periods, and rotate them regularly.
• Ensure logs and diagnostic output redact authenticated URLs.
• If this guidance has already been followed, remove credentials from remote URLs and shell history, delete insecure stored copies, and revoke and replace the exposed token.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:383

Finding

Documented Bypass of Git Security and Policy Hooks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:383-388
Vulnerability Type: Security-control bypass through --no-verify
Risk Level: Medium

bash

### Q3: How can hooks be bypassed in an emergency?
```bash
git commit --no-verify -m "hotfix: emergency fix"
# ...

text

### Technical Analysis

The Skill advertises Git hooks that check secrets, large files, debugging artifacts, and commit-message policy. It subsequently documents `git commit --no-verify`, which suppresses applicable pre-commit and commit-msg hooks.

This is a built-in Git capability rather than a software implementation defect, but presenting it as a general emergency procedure undermines the security guarantees established elsewhere in the Skill. The guidance provides no approval requirement, audit trail, compensating scan, or mandatory remote validation. Local hooks are not a sufficient security boundary by themselves, but explicitly bypassing them increases the likelihood that prohibited or sensitive content reaches repository history.

### Attack Path

1. A repository installs the security and policy hooks recommended by the Skill.
2. A developer or Agent stages content containing a secret, prohibited file, debugging code, or another policy violation.
3. The documented `git commit --no-verify` command is used.
4. Git skips the relevant local validation hooks.
5. The unchecked commit enters local repository history and may subsequently be pushed.
6. If equivalent server-side or CI enforcement is absent, the content can be merged, distributed to other developers, included in artifacts, or deployed.

### Impact Assessment

This bypass does not independently grant additional operating-system privileges. Its impact is the circumvention of repository security controls within the user's existing Git permissions.

Depending on the skipped checks, the resulting commit could disclose credentials, introduce vulnerable or unauthorized code, violate branch or commit policies, or contami
...[truncated 134 chars]

Remediation

View remediation

Remediation Suggestions

• Remove generic instructions recommending --no-verify.
• Enforce security-critical checks in protected CI jobs or server-side controls that local users cannot bypass.
• Require protected branches, mandatory status checks, and review approval before merge.
• If an emergency override is operationally necessary, require explicit authorization, record the reason and approver, and create an auditable exception.
• Run equivalent secret scanning, file validation, and policy checks before the emergency commit is pushed or merged.
• Limit emergency overrides to narrowly defined conditions and require immediate retrospective review.
• Configure secret scanning to inspect full commit history so credentials remain detectable even if local hooks are skipped.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation scope is overly broad and encourages use for generic efficiency, automation, batch processing, and workflow optimization rather than narrowly bounded Git tasks. In an agent context with read/exec/write tools, vague applicability increases the chance the skill is selected for unrelated tasks and granted authority to perform risky repository or system actions without sufficient user intent verification.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document recommends credential storage and token-in-URL authentication without clearly warning about exposure risks. This normalizes insecure secret handling in a tool intended for automation and CI/CD, where credentials can easily leak into config files, logs, build traces, screenshots, or shared shell history.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims secrets are handled via environment variables, yet elsewhere recommends embedding a token directly in a Git remote URL. Token-in-URL usage risks credential disclosure through shell history, process listings, config files, logs, screenshots, and accidental repository sharing, directly undermining the stated security model.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented use of 'git commit --no-verify' explicitly bypasses local Git hooks that may enforce secret scanning, policy checks, or quality gates. In a skill focused on hook management and workflow enforcement, providing a bypass command makes policy evasion easier and can enable unsafe or noncompliant code and secrets to be committed.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

text

### Q3:如何绕过Hook(紧急情况)?
```bash
git commit --no-verify -m "hotfix: 紧急修复"
# ...

Q4:仓库分析支持哪些指标?

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill name, summaries, descriptions, examples, and operational guidance are presented in Chinese throughout the file, with no indication that users may opt into another language. For a general-purpose development skill, this creates a locale constraint that is neither optional nor explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents branch cleanup commands that delete merged branches and enumerate stale branches without a prominent warning about destructive effects. In a real repository, users or agents could remove branches that still matter operationally, especially if merge status or branch protection assumptions are wrong, causing workflow disruption or data loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation is internally inconsistent: it first states that no extra API key is needed, then later instructs users to configure platform API keys and token-based Git authentication. Conflicting guidance around authentication can cause operators to misconfigure secrets handling, weaken review of credential flows, and normalize unsafe auth practices.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.