ClawHub
Back to skill

Security audit

Git工作流

Security checks across malware telemetry and agentic risk

Overview

This Git workflow skill is mostly understandable, but its broad activation language and unguarded destructive Git commands need human review before use.

Review this skill before installing. It should be limited to explicit Git workflow requests, and any command that discards work or rewrites history, especially reset --hard, clean -f/-fd, filter-branch, BFG deletion, reflog expiry, or aggressive gc, should require a backup and clear user confirmation first.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is advertised as a Git workflow helper, but the body expands into code review, scoring, and dependency-vulnerability analysis features that are materially different in scope. This kind of scope drift can cause overly broad activation and user trust confusion, increasing the chance the agent invokes the skill in contexts where it may read, write, or execute actions beyond what the user expected.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The documented output is a grading/report-card schema unrelated to Git task assistance, which contradicts the stated purpose of branch management, merge help, and commit guidance. Such mismatches are dangerous because they obscure what the skill actually does and can hide broader data processing or execution behavior behind an innocuous Git-focused label.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The input fields and examples describe generic content review and scoring instead of concrete Git workflow parameters. This broadens the apparent applicability of the skill and makes accidental or unnecessary invocation more likely in unrelated development contexts.

Vague Triggers

High
Confidence
97% confidence
Finding
The activation guidance is extremely broad, covering general code generation, programming assistance, debugging, testing, and deployment. Because the skill has read/exec/write tools, broad routing language substantially increases the likelihood it will be selected for many development tasks, giving it unnecessary access and making misuse or unsafe command execution more likely.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill documents destructive Git operations such as hard resets, cleaning files, history rewriting, and aggressive garbage collection without prominent irreversible-action warnings or guardrails. In an agentic context with exec capability, presenting these commands as routine troubleshooting steps can lead users or downstream agents to execute repository-damaging actions with permanent data loss.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git clean -fd                     # 删除文件和目录
# ...
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch path/to/file' \
  --prune-empty --tag-name-filter cat -- --all
# ...
bfg --delete-folders folder_name
Confidence
99% confidence
Finding
The documented history-rewrite sequence includes git rm within filter-branch and BFG folder deletion, both of which can remove tracked content across all history. In a skill that exposes exec, these are dangerous parameterized operations that can be adapted to arbitrary paths and cause widespread repository corruption or irreversible loss, especially if user input is substituted into path arguments.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git checkout COMMIT_ID -- file.txt
# ...
git reflog                        # 查找提交
git reset --hard COMMIT_ID        # 恢复
# ...
git reflog                        # 找到分支最后的提交
git checkout -b branch_name COMMIT_ID
Confidence
98% confidence
Finding
git reset --hard discards working tree and index changes and can permanently destroy uncommitted work. In this skill's context, where exec is available and the overall scope is loosely defined, documenting this command without strict safeguards creates a meaningful risk that an agent or user will apply it inappropriately and lose data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.