ClawHub
Back to skill

Security audit

git-master

Security checks for vulnerabilities and agentic risk

Overview

This git workflow skill is not malicious, but it needs review because it can rewrite history and push to remotes under broad activation rules.

Install only if you want an agent to actively manage git history. Before use, require explicit confirmation for every push, force-with-lease push, reset, rebase, stash, bisect, or other state-changing command, and avoid using it on protected or shared branches without reviewing the exact commands first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill operationalizes git push and especially git push --force-with-lease, which can alter shared remote history. Even with a warning, embedding this as a routine next step raises the risk of unauthorized or accidental remote modification, particularly when activation may be broad and history rewriting is encouraged elsewhere in the skill.

Content

Scanner excerpt · SKILL.md (reported line 563)May include surrounding context.

text
IF fixup was used AND branch has upstream:
  -> Requires: git push --force-with-lease
  -> WARN user about force push implications
  
IF only new commits:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

git reset --hard <hash> is a destructive state-changing command that can discard working tree and index changes if used incorrectly. In a skill that encourages aggressive history rewriting and recovery procedures, this materially increases the risk of irreversible local data loss from autonomous or mistaken execution.

Content

Scanner excerpt · SKILL.md (reported line 717)May include surrounding context.

md
| Situation | Command | Notes |
|-----------|---------|-------|
| Rebase going wrong | `git rebase --abort` | Returns to pre-rebase state |
| Need original commits | `git reflog` -> `git reset --hard <hash>` | Reflog keeps 90 days |
| Accidentally force-pushed | `git reflog` -> coordinate with team | May need to notify others |
| Lost commits after rebase | `git fsck --lost-found` | Nuclear option |
</rebase_execution>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

These instructions include both git push -u origin <branch> and git push --force-with-lease origin <branch>, enabling outbound remote writes and history replacement. In an agent skill, that is dangerous because it converts local analysis/rewrite behavior into externally visible repository mutation that may affect collaborators or CI/CD flows.

Content

Scanner excerpt · SKILL.md (reported line 745)May include surrounding context.

text
IF branch never pushed:
  -> git push -u origin <branch>

IF branch already pushed:
  -> git push --force-with-lease origin <branch>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
74% confidence
Finding

Although the surrounding text recommends --force-with-lease rather than plain --force, the presence of force-push guidance still reflects a destructive remote-write capability. In context, the danger is real but somewhat reduced because the skill does not explicitly instruct unsafe plain --force usage.

Content

Scanner excerpt · SKILL.md (reported line 770)May include surrounding context.

NEXT STEPS:

  • git push --force-with-lease origin
  • Review changes before merge
text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrase design is overly broad, especially with generic terms like 'commit' and history questions that may appear in ordinary conversation. Overbroad activation increases the chance that the skill runs unexpectedly and applies powerful git instructions in contexts where the user did not intend repository modification or history rewriting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase design is overly broad, especially with generic terms like 'commit' and history questions that may appear in ordinary conversation. Overbroad activation increases the chance that the skill runs unexpectedly and applies powerful git instructions in contexts where the user did not intend repository modification or history rewriting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes local git workflow support, but the skill instructs network-affecting operations such as fetch and push. That mismatch can cause the agent to perform external state changes or communicate with remotes when the operator expected only local repository analysis/manipulation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes this skill as one to use for git actions like commits, rebases, squashes, and history search. In Phase 5.1, the skill also instructs use of TodoWrite to register tracking items, which is outside git functionality and not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.