T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/publish.sh:174
- Finding
- Unrestricted Directory Contents May Be Published to a Public GitHub Repository<![CDATA[ ## Vulnerability Details **File Location**: `scripts/publish.sh`, lines 174-187 **Vulnerability Type**: Uncontrolled publication of potentially sensitive files **Risk Level**: High ### Vulnerable Code ```bash # Initialize git if needed if [ ! -d ".git" ]; then echo "🔧 Initializing git..." git init git add . git commit -m "Initial commit: $SKILL_NAME v$VERSION" fi # Create GitHub repo echo "🐙 Creating GitHub repository..." if ! gh repo view >/dev/null 2>&1; then gh repo create "$SKILL_NAME" --public --source=. --remote=origin --push || { ``` ### Technical Analysis The script executes `git add .`, recursively staging every non-ignored file under the selected skill directory. It subsequently invokes `gh repo create` with the `--public` and `--push` options, causing the staged contents to be uploaded to a publicly accessible GitHub repository. No controls are implemented to: - Restrict publication to an explicit allowlist of expected skill files. - Detect credentials, private keys, access tokens, `.env` files, logs, backups, or local configuration. - Verify that an effective `.gitignore` exists. - Display and validate the complete staged file list before publication. - Scan the commit or Git history for secrets. - Obtain a dedicated confirmation acknowledging that the repository will be public. The general publication confirmation does not identify the files that will be exposed. Although ignored files are not staged, the script does not establish or validate ignore rules. Sensitive files already tracked in an existing repository may also be pushed through the existing-repository branch. ### Attack Path 1. A sensitive file, such as `.env`, a private key, an API token file, a configuration backup, or a log containing credentials, is present in the selected skill directory. 2. The file is not covered by an existing `.gitignore` rule, or it is already tracked by Git. 3. The user approves the general GitHub and ClawdHub publicat ...[truncated 1294 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Replace recursive staging with an allowlist.** Stage only files expected in a skill package, such as: ```bash git add -- SKILL.md README.md VERSION scripts/ ``` 2. **Validate the selected directory before staging.** Reject common sensitive paths and file patterns, including: - `.env` and `.env.*` - `*.pem`, `*.key`, `*.p12`, and `*.pfx` - SSH keys - Cloud credential files - Authentication tokens - Database exports, logs, archives, and backup files 3. **Require and validate `.gitignore`.** Provide secure defaults and verify that sensitive local files are excluded. Do not rely on `.gitignore` as the only security control because previously tracked files remain publishable. 4. **Show the exact publication set.** Before committing or pushing, display: ```bash git status --short git diff --cached --name-only ``` Require explicit confirmation after the user reviews this list. 5. **Run secret detection before publication.** Scan both staged content and relevant Git history using a maintained secret scanner. Abort publication when high-confidence credentials or private keys are detected. 6. **Default to a private repository.** Create private repositories unless the user separately and explicitly confirms public visibility: ```bash gh repo create "$SKILL_NAME" --private --source=. --remote=origin --push ``` 7. **Validate existing repositories as well.** Before `git push`, inspect tracked files, staged changes, repository visibility, remote ownership, and Git history for sensitive material. 8. **Provide incident guidance.** If a secret has already been published, instruct the user to revoke and rotate it immediately, remove it from Git history, invalidate affected sessions, and review access logs. Deleting only the working-tree file is insufficient. ]]>