Security audit

Git版本控制工具

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a Git helper, but it asks for broad read/write/command authority while also documenting generic API credentials, file processing, and system command execution beyond a clearly scoped Git workflow.

Install only if you want an agent to help with Git operations inside repositories and you are comfortable granting read, write, and command execution. Avoid giving it unrelated API keys, review commands before destructive Git actions such as rebase/reset/force-push, and use it in repositories where you have backups or recoverable history.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims command execution is limited to a whitelist, but the manifest only exposes a generic exec capability and provides no concrete whitelist, validation logic, or enforcement boundary. In an agent context, this mismatch can cause operators or downstream systems to over-trust the skill and allow arbitrary shell execution, which is especially dangerous for a tool that may run inside developer workspaces with source code, credentials, and Git remotes available.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a Git tool but also instructs users to configure generic API keys and establish API connections, expanding it beyond its stated purpose into external service access. This scope creep increases the chance that an agent will request, handle, or expose secrets unnecessarily, and creates ambiguity about what networked actions the skill may perform.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation broadens the skill from Git workflows to generic file processing, external API integration, and system command execution. In a skill with read/write/exec tools, that functional expansion materially increases attack surface because prompts intended for benign Git tasks could be repurposed into arbitrary local command execution, file access, or exfiltration-oriented API calls.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation text is overly broad, including generic efficiency, automation, batch processing, and workflow optimization language that can match many unrelated requests. In agent-routing contexts, this can cause the Git skill to be invoked outside its intended domain, exposing read/write/exec capabilities in situations where a narrower, safer tool should have been used.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill supports potentially destructive Git operations such as rebase, merge, history recovery, and command execution, but the description lacks strong warnings or guardrails around data loss, force-pushes, resets, or working-tree modification. This increases the risk that users or agents will perform irreversible repository changes without adequate confirmation or backup expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.