Git Watcher

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent local Git configuration-management purpose, but it handles OpenClaw credentials and restores with under-scoped safeguards that can expose or overwrite sensitive local data.

Install only if you are comfortable with a local tool modifying and committing files under ~/.openclaw. Before using commit or restore, back up ~/.openclaw, avoid tracking live credentials, review the exact files being staged, and treat diff/log/commit-message output as potentially sensitive.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/git_manager.py:458

Finding

Commit operation stages files outside the declared configuration allowlist

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/git_manager.py:56

Finding

Heuristic secret detection can commit unsupported credentials in plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/git_manager.py:158

Finding

Raw diff and commit-message output can disclose secret values

Content

View full analysis

40: return f'"{val[:37]}..."' return f'"{val}"' if isinstance(val, list): if len(val) > 5: return f"[{len(val)} items]" return str(val) if isinstance(val, dict): return f"{{{len(val)} keys}}" return repr(val) ``` ```python print("─" * 60) for line in stdout.splitlines(): if any(t in line for t in ("+++", "---", "diff", "index")): continue print(line) ``` ```python diff_desc = _generate_diff_description() if not message and auto_message and diff_desc: # Build commit message: subject + body short_summary = "; ".join( sorted(set( p.split("/")[0] if "/" in p else p for p in valid_files ))[:5] ) message = f"config: update {short_summary}\n\n{diff_desc}" ``` ### Technical Analysis `cmd_diff()` prints patch lines without applying secret redaction. It removes selecte ...[truncated 1815 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/git_manager.py:298

Finding

Secret redaction destructively overwrites live credential and configuration files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The skill explicitly includes a destructive command path using git reset --hard <commit>, which can irreversibly discard uncommitted local changes. Even with a note about requiring explicit user confirmation, encoding this operation in the skill creates a high-risk avenue for destructive state changes, especially if commit parameters or user intent are misparsed by an agent.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

Restore modes:
- **Full tree restore**: `git checkout <commit> -- .` (all tracked files)
- **Single file restore**: `git checkout <commit> -- path/to/file`
- **Hard reset** (destructive): `git reset --hard <commit>` — only if user explicitly says "hard reset"

Do not:
- Perform destructive restores (hard reset, force checkout) without explicit user confirmation

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include very generic terms such as "restore," "rollback," and "what changed," which are likely to occur in ordinary conversation outside the intended git/config-management context. In an agent skill that can commit or restore configuration state, accidental activation could lead to unintended version-control operations or rollback workflows being initiated at the wrong time.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell commands and file-modifying operations but does not declare any explicit tool scope or permissions boundaries. In an agent system, this creates an authorization gap: the skill can induce broad filesystem and command execution behavior without a machine-readable restriction, increasing the chance of overbroad access, unsafe invocation context, or privilege misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

2. If the user names a specific file: restore only that file to the commit's version
3. Show a preview diff first: what will change from current state
4. Require user confirmation before overwriting current files
5. After restore, create an automatic recovery commit marking the restore point:
   `config: restore to <hash> (<description>)`
6. Report which files were changed and the new HEAD commit

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_manager.py (reported line 71)May include surrounding context.

python

def git(*args, cwd=REPO_DIR, capture=True):
    if capture:
        result = subprocess.run(
            ["git"] + list(args), cwd=cwd, capture_output=True, text=True,
        )
        return result.stdout.strip(), result.stderr.strip(), result.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_manager.py (reported line 76)May include surrounding context.

python

)
        return result.stdout.strip(), result.stderr.strip(), result.returncode
    else:
        result = subprocess.run(["git"] + list(args), cwd=cwd)
        return "", "", result.returncode

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/git_manager.py (reported line 314)May include surrounding context.

python

if not found:
        return False, []

    # Write redacted version
    with open(full, "w") as f:
        f.write(redacted)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_manager.py (reported line 336)May include surrounding context.

python

def run_doctor():
    """Run openclaw gateway doctor and return (ok, output)."""
    result = subprocess.run(
        ["openclaw", "gateway", "doctor"],
        cwd=OPENCLAW_DIR,
        capture_output=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The commit workflow stages every changed file reported by git status except nested git directories, rather than restricting operations to TRACKED_PATHS. In a configuration directory that may also contain tokens, logs, transient data, or attacker-planted files not covered by .gitignore, this can persist unintended sensitive or malicious content into version history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Before staging, the script rewrites credential-bearing files in place to redact suspected secrets, changing the user's working configuration without prior confirmation or creating a backup. This can silently break live credentials, destroy original secret values, and produce denial-of-service or recovery problems if the redaction regex overmatches or the user expected a non-destructive commit flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The restore path accepts an arbitrary --file value and uses git checkout <target> -- <file> or restores the entire tree, without enforcing that the path is one of the intended OpenClaw configuration targets. This enables destructive modification of any file in the repository, which is especially risky because the repository root is ~/.openclaw, a directory likely to contain security-sensitive material beyond the intended config set.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/git_manager.py (reported line 572)May include surrounding context.

python

diff_cmd += ["--", file_path]
    else:
        diff_cmd += [target, "--"]
    diff_out = subprocess.run(diff_cmd, cwd=REPO_DIR,
                               capture_output=True, text=True)

    what = file_path or "(all tracked files)"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The restore flow performs destructive checkout operations and then automatically runs a validation subprocess; on force/undo paths, the safety confirmation is bypassed. That combination can overwrite repository files and trigger additional side effects with reduced user awareness, increasing the chance of accidental data loss or unintended operational changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/git_manager.py (reported line 684)May include surrounding context.

python

restore_p.add_argument("--undo", action="store_true", help="Undo last restore")
    restore_p.add_argument("--file", help="Restore specific file only")
    restore_p.add_argument("-f", "--force", action="store_true",
                          help="Skip confirmation")

    args = parser.parse_args()
    cmd = args.command

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill description is written entirely in Chinese while the listed trigger phrases are in English, and there is no statement that users may choose their preferred language or that the skill is intentionally region-specific. This can be read as a locale/language policy issue because the skill does not document language expectations or provide opt-in choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline comment states that the script logs 'actual secret hashes (not the secrets themselves) for audit', but the appended log entries contain only file, type, timestamp, and a static commit hint. This is an active contradiction between documentation and implementation, which could mislead reviewers about the audit trail's strength.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest frames this skill as a Git manager for tracking, comparing, committing, and rolling back configuration changes, but the code also executes openclaw gateway doctor after restore. Running service diagnostics is an additional operational capability that is not clearly justified by a version-control-focused skill description.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as PyYAML>=6.0 without an upper bound or exact pin, which makes builds non-reproducible and allows different environments to resolve to different releases. This increases supply-chain risk and can unexpectedly introduce vulnerable or breaking versions over time, even if it is not an immediately exploitable flaw by itself.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

PyYAML>=6.0

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because the manifest does not pin a specific PyYAML version, it is impossible to verify from this file alone whether deployment will use a release affected by known PyYAML advisories. In a skill that manages configuration data, YAML parsing may plausibly be used on user- or repo-controlled content, which makes ambiguity around parser version more security-relevant than in a purely internal library.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.