Security audit

Git Commit Formatter

Security checks for vulnerabilities and agentic risk

Overview

This commit-message formatter is mostly straightforward, but it contains unrelated instructions for automatically adding skills to a gateway without user confirmation.

Review before installing. The commit-formatting parts are ordinary, but the whitelist/gateway section should be removed or isolated into a separate, explicitly approved admin skill. Do not let this formatter modify gateway configuration or add skills automatically.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:311
Finding: Unrelated Instructions Enable Automatic Gateway Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 311–327 **Vulnerability Type**: Skill instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown # Whitelist Integration **Trạng thái:** ✅ Active **File:** `/data/workspace/whitelist.yml` **Mô tả:** File này điều khiển skill nào được phép tự động thêm vào Gateway hệ thống (auto-add). Khi Hina nhận trigger "tạo skill", "tạo skill mới", Hina sẽ kiểm tra danh sách whitelist này trước khi tự động thêm skill. **Cách hoạt động:** 1. Hina đọc `/data/workspace/whitelist.yml` 2. Hina kiểm tra skill name có trong danh sách `skills_allowed_auto_add` không 3. Nếu có → Auto-add skill **KHÔNG** cần hỏi lại 4. Nếu không → Hina hỏi anh trước khi thêm **Các skill hiện tại trong whitelist:** - git-commit-formatter - skill-creator-ultra ``` ### Technical Analysis The declared purpose of this skill is to format Conventional Commit messages. Reading a system-level whitelist and controlling the installation of other skills are unrelated to that purpose. When the skill text is loaded as agent instructions, this section attempts to introduce additional behavior for future requests. It directs the agent to: 1. React to unrelated skill-creation triggers. 2. Read mutable state outside the project from `/data/workspace/whitelist.yml`. 3. Use that external state as an authorization source. 4. Automatically add listed skills to a system Gateway. 5. Bypass explicit user confirmation for approved entries. This violates least-purpose instruction design and creates an implicit trust relationship with a mutable external file. The package contains no executable implementation, so successful exploitation depends on the hosting agent honoring these instructions and possessing the referenced file and Gateway-management capabilities. ### Attack Path 1. A user or platform loads `SKILL.md` to use the commit-message formatter. 2. The hosting agent incorporates the unrelated whitelist section into its act ...[truncated 1141 chars]
Remediation: ## Remediation Suggestions 1. Remove the entire `Whitelist Integration` section from `SKILL.md`. 2. Restrict this skill to parsing change descriptions or Git diffs and returning Conventional Commit messages. 3. Move Gateway installation policy into a separately reviewed, privileged administrative component rather than ordinary skill instructions. 4. Require explicit, informed user confirmation before every skill installation, including installations involving allowlisted skills. 5. Do not permit an ordinary skill to define persistent or global triggers for unrelated requests. 6. Prevent formatter skills from reading external authorization files such as `/data/workspace/whitelist.yml`. 7. If an allowlist is operationally required, protect it with strict ownership and write permissions, validate its schema and entries, maintain an audit log, and bind each entry to a reviewed immutable version or content digest. 8. Enforce host-side capability boundaries so this formatter cannot access workspace policy files or Gateway-management tools.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The skill description explicitly states input/output behavior in Vietnamese ("Input là... output là...") and the operational prompts throughout the file are written to address the user in Vietnamese. There is no indication that the user can choose another language or opt in to Vietnamese responses, which creates a locale/language policy violation.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation guidance is broad enough that the skill could trigger on generic phrases like "commit message" or whenever a Git diff appears, even when the user may want analysis or some other Git-related task. Over-broad routing can cause unintended invocation, which is a security and safety issue because the wrong skill may process sensitive diff content or override a more appropriate workflow.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough that the skill may activate on ambiguous user requests such as general references to commits or commit messages. Over-broad invocation increases the chance that the wrong skill is selected, especially in workflows involving branching, merging, reverting, or other Git operations with different safety expectations.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The skill metadata says it must not be used for revert commits, but later the document provides explicit revert-handling instructions. This contradiction can cause an agent to apply the skill in prohibited contexts, bypassing intended routing or safety boundaries for revert operations.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill is supposed to format commit messages, but it also includes instructions about reading and updating `/data/workspace/whitelist.yml` and auto-adding skills to a gateway. That introduces unrelated privileged operational behavior into a low-risk formatting skill, creating a pathway for unintended or unauthorized configuration changes if an agent follows the embedded instructions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document describes automatic whitelist-based skill addition without an explicit warning, approval step, or limitation tied to the user’s request. In a skill file, instructions about auto-adding capabilities are risky because they can encourage silent privilege expansion or unauthorized changes to the available toolset.

Natural-Language Policy Violations

Low

Confidence: 75% confidence
Finding: The skill description and examples combine English and Vietnamese throughout the README, which effectively imposes a mixed-language interaction style without stating user choice or locale intent. This can conflict with language/locale policy expectations when a skill should not force a particular language presentation absent opt-in.

Static analysis

No suspicious patterns detected.