ClawHub
Back to skill

Security audit

Git工作流

Security checks for vulnerabilities and agentic risk

Overview

This Git workflow skill is mostly understandable, but its broad activation language and unguarded destructive Git commands need human review before use.

Review this skill before installing. It should be limited to explicit Git workflow requests, and any command that discards work or rewrites history, especially reset --hard, clean -f/-fd, filter-branch, BFG deletion, reflog expiry, or aggressive gc, should require a backup and clear user confirmation first.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is advertised as a Git workflow helper, but the body expands into code review, scoring, and dependency-vulnerability analysis features that are materially different in scope. This kind of scope drift can cause overly broad activation and user trust confusion, increasing the chance the agent invokes the skill in contexts where it may read, write, or execute actions beyond what the user expected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documented output is a grading/report-card schema unrelated to Git task assistance, which contradicts the stated purpose of branch management, merge help, and commit guidance. Such mismatches are dangerous because they obscure what the skill actually does and can hide broader data processing or execution behavior behind an innocuous Git-focused label.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The input fields and examples describe generic content review and scoring instead of concrete Git workflow parameters. This broadens the apparent applicability of the skill and makes accidental or unnecessary invocation more likely in unrelated development contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation guidance is extremely broad, covering general code generation, programming assistance, debugging, testing, and deployment. Because the skill has read/exec/write tools, broad routing language substantially increases the likelihood it will be selected for many development tasks, giving it unnecessary access and making misuse or unsafe command execution more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill documents destructive Git operations such as hard resets, cleaning files, history rewriting, and aggressive garbage collection without prominent irreversible-action warnings or guardrails. In an agentic context with exec capability, presenting these commands as routine troubleshooting steps can lead users or downstream agents to execute repository-damaging actions with permanent data loss.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The documented history-rewrite sequence includes git rm within filter-branch and BFG folder deletion, both of which can remove tracked content across all history. In a skill that exposes exec, these are dangerous parameterized operations that can be adapted to arbitrary paths and cause widespread repository corruption or irreversible loss, especially if user input is substituted into path arguments.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md
git clean -fd                     # 删除文件和目录
# ...
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch path/to/file' \
  --prune-empty --tag-name-filter cat -- --all
# ...
bfg --delete-folders folder_name

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

git reset --hard discards working tree and index changes and can permanently destroy uncommitted work. In this skill's context, where exec is available and the overall scope is loosely defined, documenting this command without strict safeguards creates a meaningful risk that an agent or user will apply it inappropriately and lose data.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md
git checkout COMMIT_ID -- file.txt
# ...
git reflog                        # 查找提交
git reset --hard COMMIT_ID        # 恢复
# ...
git reflog                        # 找到分支最后的提交
git checkout -b branch_name COMMIT_ID

Static analysis

No suspicious patterns detected.