ClawHub
Back to skill

Security audit

Git高级操作专业版

Security checks for vulnerabilities and agentic risk

Overview

This is a Git workflow guidance skill whose command examples fit its stated purpose, though users should review destructive Git commands before running them.

Install only if you want an agent to help with advanced Git tasks. Before running suggested commands, especially rm -rf, git rm, git push, global git config changes, merge, cherry-pick, or cache-clearing commands, confirm the target repository, branch, paths, and working-tree state.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill includes destructive Git and shell operations such as git rm and rm -rf .git/modules/lib/shared without prominent warnings, backups, or confirmation requirements. In an agent context with exec and write tools, this can lead to irreversible repository damage, loss of history references, or accidental deletion if a user follows or the agent executes the commands blindly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.