ClawHub
Back to skill

Security audit

Git高级操作专业版

Security checks for vulnerabilities and agentic risk

Overview

This is a Git workflow guidance skill whose command examples fit its stated purpose, though users should review destructive Git commands before running them.

Install only if you want an agent to help with advanced Git tasks. Before running suggested commands, especially rm -rf, git rm, git push, global git config changes, merge, cherry-pick, or cache-clearing commands, confirm the target repository, branch, paths, and working-tree state.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes destructive Git and shell operations such as `git rm` and `rm -rf .git/modules/lib/shared` without prominent warnings, backups, or confirmation requirements. In an agent context with `exec` and `write` tools, this can lead to irreversible repository damage, loss of history references, or accidental deletion if a user follows or the agent executes the commands blindly.

Static analysis

No suspicious patterns detected.