T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_git_commits.sh:32- Finding
Arbitrary Command Execution Through Git Log Argument Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
commit-history-exporter
Security checks for vulnerabilities and agentic risk
Overview
The skill is a repository history exporter, but its shipped shell scripts use unsafe command construction and encourage insecure SVN password handling, so it needs review before installation.
Install only after reviewing and preferably fixing the scripts. Avoid passing SVN passwords on the command line; use SVN's credential cache or an interactive/protected secret flow. Treat exported reports as sensitive because they may include names, emails, commit messages, file paths, and repository URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_svn_commits.sh:39- Finding
SVN Command Injection and Plaintext Credential Exposure
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_git_commits.sh:15- Finding
Unsanitized Author Values Used in Git Report Paths
- Content
View full analysis
"$OUTPUT_FILE" echo "" >> "$OUTPUT_FILE" ``` ### Technical Analysis `AUTHOR` is a caller-controlled string and is inserted directly into a filesystem path. Quoting `"$OUTPUT_FILE"` prevents shell word splitting but does not neutralize path separators or `..` traversal components. An author value containing `/` and `..` can cause path normalization to resolve outside the intended repository directory when the required intermediate directories exist. The script does not constrain output to a dedicated export directory and does not canonicalize or validate the final path before opening it. The timestamp suffix makes targeting an exact existing filename less straightforward, but it does not prevent creation of reports in unintended writable directories. Predictable timestamps and filesystem links may also increase overwrite or redirection risk in environments where an attacker can prepare the destination. ### Attack Path 1. The attacker ensures a suitable intermediate directory exists in the repository, such as `git_commits_x`. 2. The attacker supplies an author value containing traversal components: ```text x/../../outside ``` 3. The resulting relative path resembles: ```text git_commits_x/../../outside_.markdown ``` 4. Filesystem path resolution escapes the repository directory. 5. The report is created in an unintended parent or sibling directory if that destination is writable. ### Impact Assessment The vulnerability can create report files outside the selected Git repository under the privileges of the invoking account. The ...[truncated 462 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_svn_commits.sh:18- Finding
Unsanitized Author Values Used in SVN Report Paths
- Content
View full analysis
"$OUTPUT_FILE" ``` and: ```bash python3 << 'PYTHON_SCRIPT' >> "$OUTPUT_FILE" ``` ### Technical Analysis The caller-controlled `AUTHOR` value is embedded directly in the report path without filename sanitization. Shell quoting protects against argument splitting and glob expansion, but it does not prevent `/` or `..` from affecting filesystem resolution. If matching intermediate directories exist, traversal components can direct the generated report outside the selected SVN working copy. The report destination is not checked against a trusted export root before it is opened. As with the Git exporter, the timestamp reduces direct control over the complete filename but does not prevent unintended placement. Symbolic links or prepared directories can increase the practical risk. ### Attack Path 1. An attacker prepares or identifies an intermediate directory such as `svn_commits_x`. 2. The attacker invokes the script with an author value such as: ```text x/../../outside ``` 3. The script generates a path resembling: ```text svn_commits_x/../../outside_.detailed ``` 4. Filesystem path resolution escapes the SVN working-copy directory. 5. The script writes the detailed report to an unintended writable location. ### Impact Assessment An attacker can redirect report creation outside the selected SVN repository, subject to filesystem permissions and the existence of usable intermediate paths. The resulting file may disclose repository metadata, including author identities, revision numbers, dates, commit messages ...[truncated 285 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
该代码的总体方向与声明部分一致，确实是在导出代码提交记录，并支持作者、时间范围、项目路径过滤，也能输出多种格式。但存在明显的功能性描述不符：首先，代码会检查 .git 目录并调用 git log/git show，完全没有任何 SVN 支持；其次，声明中的 Detailed 格式未实现，支持格式仅为 markdown、csv、json；再次，所谓‘完整提交日志’并未实现，脚本没有导出完整 diff 或更完整的提交内容，只输出 commit id、作者、时间、message 和文件变更信息。因此应判定为描述与实际行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
描述与代码存在实质性不一致。首先，声明覆盖 SVN 和 Git，但代码块只处理 SVN 仓库，未见任何 Git 相关逻辑。其次，声明称支持多种导出格式，但代码中仅 detailed 分支有明确实现，markdown/csv/json 分支只是“原有代码”占位，无法证明已实现。再次，声明提到按时间范围过滤，而当前脚本参数与核心查询主要依据起止修订号范围，不是等价的时间过滤。最后，脚本在无认证时会读取本地 .svn/wc.db SQLite 数据库作为回退，这属于实际资源访问行为，虽然可视为实现细节，但描述未体现这种本地数据库读取方式。总体上，代码的实际范围明显小于且不同于声明，因此应判定为不匹配。
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation instructs users to pass SVN usernames and passwords directly on the command line, which can expose secrets through shell history, process listings, audit logs, and terminal recordings. In a skill specifically handling repository access, this is more dangerous because the same credentials may grant broad access to source code history and internal project information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section again recommends supplying SVN passwords inline in the command, without a clear security warning. That practice materially increases credential leakage risk to local users, monitoring tools, CI logs, and support screenshots, and the resulting compromise could expose private repository contents and historical commit data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase uses an open-ended '等类似请求', which can cause the skill to activate on broader requests than intended. In this context, that raises the chance of unplanned repository-history access or export of commit metadata when a user asked something only loosely related, increasing the risk of unintended disclosure of developer activity, file paths, and commit messages.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script and surrounding guide present output as SVN commit-record/history reporting, but the data source is only the local .svn/wc.db working-copy metadata. In this skill’s context, that can mislead users into believing they exported authoritative commit history or detailed logs when commit messages, deleted history, and non-fetched revisions are unavailable, creating integrity and audit errors.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's comments, status messages, errors, and usage text are all written in Chinese, which imposes a specific language on users without any opt-in or documented regional justification. This matches the policy category for language or locale constraints expressed in natural-language content.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest states the skill supports Markdown, CSV, JSON, and Detailed formats, with Detailed including full commit logs. In code, FORMAT is documented and enforced as only markdown, csv, or json, and any other value is rejected, so the implemented behavior does not match the advertised capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script exports author email addresses from repository history into generated reports without minimization, masking, or any warning that personally identifiable information will be written to disk. In this skill context, the tool is explicitly designed to export and share commit history, which increases the chance that reports are redistributed beyond the original repository audience and exposes contributor contact data unnecessarily.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script accepts SVN credentials as positional command-line arguments and later uses them to build an SVN command. Command-line arguments are commonly exposed via process listings, shell history, audit logs, and orchestration telemetry, so this creates a real credential-exposure risk even if the feature is intended to access protected logs. In this skill context, exporting commit history does not inherently require insecure password handling, so the behavior is more dangerous than necessary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script not only accepts credentials on the command line but does so without any warning about password exposure risks. This increases the chance users will paste sensitive credentials into an unsafe invocation pattern, leading to accidental disclosure through ps output, shell history, CI logs, or agent traces. The skill's repository-export purpose makes this unnecessary and elevates concern because users may trust automation to handle secrets safely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comment at L151 says it queries modifications for the specified author, and the code tries to read sys.argv[1] at L152. However, because the here-document invocation is malformed for passing arguments, the Python script does not actually receive "$AUTHOR", so the documented filtering intent contradicts the implemented behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
L004 的描述和触发短语全部以中文给出，文件整体也仅提供中文使用方式，未说明这是面向特定中文环境的区域性技能，也未给出语言可选项。若组织要求不得在无用户选择的情况下强制特定语言，这属于自然语言层面的 locale/policy 风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
A language-specific skill reference can be a policy concern when it implicitly forces one language without stating that the content is intended for that locale or offering alternatives. This file presents all user-facing guidance exclusively in Chinese with no opt-in or documented locale scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents commands that export git history to TXT, CSV, and JSON files, including author and email fields. Because commit logs can contain personal data and the outputs persist on disk, a brief warning about handling and sharing exported files would help users understand the privacy impact.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all instructions and examples exclusively in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file includes examples that print the repository URL from the local SVN database and later sections query and enumerate author names and file histories. Because the document does not warn that these outputs may reveal internal infrastructure details and personal contribution metadata, users are not alerted to the privacy implications of running the examples.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The report generator docstring and printed headings say 'SVN 提交记录报告' even though the report is derived solely from local working-copy state. That wording can cause users to overtrust incomplete results, especially in compliance, forensics, or personnel-review workflows where source accuracy matters.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
All user-facing comments and terminal output are written in Chinese, with no indication that the skill is region-specific or that another language can be selected. This is a natural-language policy concern because it imposes a specific language/locale without opt-in.
- Content