Security audit

Smart Git Backup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Git backup helper, but it can automatically commit and push all repository changes to a remote without confirmation.

Install only if you are comfortable with a script that can commit and push the entire current Git working tree to `origin`. Before running it, check `git status`, ensure secrets and private files are ignored, and consider modifying it to require an explicit file preview and confirmation before staging, committing, or pushing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync.sh:76
Finding: Unrestricted Staging and Upload of Potentially Sensitive Repository Contents
Content: View full analysis
/dev/null; then log_success "Successfully pushed to remote." else log_warning "Standard push failed (no upstream set). Attempting to set upstream..." if git push --set-upstream origin "$CURRENT_BRANCH" 2>/dev/null; then log_success "Successfully pushed with new upstream branch tracking." ``` ### Technical Analysis The script recursively stages all tracked and untracked files that are not already excluded by Git configuration through `git add .`. It subsequently commits and pushes those files to the configured `origin` remote without: - Restricting the backup to an explicit allowlist of intended memory files. - Detecting credentials, private keys, tokens, `.env` files, or other sensitive configuration. - Displaying the staged file list for approval. - Requiring confirmation before transmitting data to the remote repository. The large-file scan only excludes files based on size and provides no protection against small sensitive files. Although `SKILL.md` advises users not to commit credentials, this is documentation rather than an enforced security control. Once sensitive content is committed and pushed, deleting the working-tree file does not necessarily remove it from Git history. Anyone with access to the remote repository or its historical objects may continue to retrieve the exposed content. ### Attack Path 1. ...[truncated 1432 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script mutates repository state by appending detected large-file paths to .gitignore and removing them from the Git index automatically, without user review. This can silently alter project behavior, hide important artifacts from version control, and cause data loss from the tracked history of files the user may have expected to back up.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically stages all changes, creates a commit, and pushes to the configured remote without any confirmation, dry-run, or allowlist of files. In a backup-oriented skill operating on a workspace, this can unintentionally transmit sensitive files, credentials, notes, or unrelated repository changes to a remote destination, especially because git add . is broad and the remote URL is only displayed, not approved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.