T09 · Insecure Skill Coding Practices
- Location
scripts/push_to_remotes.sh:30- Finding
Unconfirmed Force-Push Can Overwrite Remote Repository History
- Content
View full analysis
Vulnerability Details
File Location:
scripts/push_to_remotes.sh, lines 30–38
Vulnerability Type: Destructive repository operation without enforced confirmation
Risk Level: MediumComplete Code Snippet
bash if [ -n "$GITHUB_TOKEN" ]; then echo "Pushing to GitHub..." git push github master --force 2>&1 | grep -v "ghp_" || true echo "✅ Pushed to GitHub" fi if [ -n "$GITEE_TOKEN" ]; then echo "Pushing to Gitee..." git push gitee master --force 2>&1 | grep -v "cf343" || trueTechnical Analysis
The publishing script unconditionally uses
git push --forcewhenever the corresponding repository token is present. It does not require a dedicated force-push confirmation flag, perform a dry run, verify the expected remote state, or use--force-with-lease.A force-push permits the local
masterbranch to replace remote branch history even when the remote contains commits absent from the local checkout. Token presence is treated as sufficient authorization for this destructive operation, although possession of a publishing token does not necessarily imply authorization to discard intervening remote changes.The pipeline also ends with
|| true, suppressing failures fromgit pushorgrep. The script then prints a success message regardless of the real push result, which can mislead an operator or automation system about whether publication succeeded.This is high-risk behavior rather than evidence of malicious intent.
Attack Path
- A user or agent configures
GITHUB_TOKENorGITEE_TOKENwith write access to the hardcoded repository. - The remote
masterbranch acquires commits that are not present in the local checkout, whether through another contributor, CI automation, or an outdated local clone. - The user or agent invokes
scripts/push_to_remotes.sh. - The script creates an authenticated remote using the configured token.
- The unconditional
--forcepush replaces the remote branch refer ...[truncated 1067 chars]
- A user or agent configures
- Remediation
View remediation
Remediation Suggestions
- Remove
--forceand use a normal push for routine publishing. - If history replacement is an explicit requirement, use
--force-with-leaseso the operation fails when the remote branch has changed unexpectedly. - Require an explicit destructive-operation flag such as
--confirm-force, and display the exact repository, branch, and commit transition before proceeding. - Fetch the remote branch and verify its current commit before attempting a history-changing push.
- Respect repository branch-protection controls and use a dedicated release branch or pull-request workflow where practical.
- Remove
|| true; preserve and return the actual push exit status. - Print success only after confirming that
git pushexited successfully. - Avoid embedding tokens in persistent Git remote URLs. Prefer a credential helper or temporary authenticated invocation, and remove temporary authenticated remotes after use.
- Remove