Back to skill

Security audit

Git工作流

Security checks across malware telemetry and agentic risk

Overview

This Git workflow skill is broadly coherent, but it gives an agent command/write authority and includes destructive Git cleanup and history-rewrite examples without strong user-control guardrails.

Install only if you want an agent to help with Git operations and are comfortable reviewing every proposed command before execution. Do not let it run destructive cleanup, reset, history-rewrite, or garbage-collection commands unless you have backups and have explicitly confirmed the target repository, branch/ref, and path scope.

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The skill claims command execution occurs in a 'safe sandbox', but the document also instructs use of destructive Git operations that can rewrite history or delete data, without defining any real sandbox enforcement. This mismatch can cause users or agents to over-trust the skill and run dangerous commands under a false assumption of containment.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
The skill is presented as a Git workflow helper, but later claims broader file handling, API integration, and command execution capabilities. This scope expansion increases attack surface and may cause an agent to invoke the skill for actions beyond the user's expected Git-related task, including networked or file-mutating behavior.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation guidance is overly broad, covering general code generation, debugging, testing, and deployment, which far exceeds a narrow Git workflow assistant. Over-broad routing increases the chance the agent grants this skill access to repositories, files, or command execution in situations where a safer, narrower skill should have been used.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document includes destructive commands such as git reset --hard, git clean -fd, filter-branch, and BFG usage without prominent warnings about irreversibility, backups, or safer alternatives. In an agent-execution context, these examples can be copied or operationalized directly, causing permanent loss of work, repository corruption, or removal of important files/history.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git clean -fd                     # 删除文件和目录
# ...
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch path/to/file' \
  --prune-empty --tag-name-filter cat -- --all
# ...
bfg --delete-folders folder_name
Confidence
97% confidence
Finding
The skill documents a history-rewriting command that invokes git rm within filter-branch across --all refs, which can remove tracked content from repository history at scale. If an agent parameterizes or adapts this pattern with user-influenced paths, it can delete unintended content, rewrite all branches/tags, and create difficult-to-recover integrity damage.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
git checkout COMMIT_ID -- file.txt
# ...
git reflog                        # 查找提交
git reset --hard COMMIT_ID        # 恢复
# ...
git reflog                        # 找到分支最后的提交
git checkout -b branch_name COMMIT_ID
Confidence
96% confidence
Finding
git reset --hard discards working tree and index changes and can move branch state destructively. In an agent skill with exec capability, presenting this command without strict guardrails invites accidental or automated data loss, especially when paired with generic recovery language that may encourage unsafe execution.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.