Git Commit Formatter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:45 AM UTC
• Version: 1.0.0

Overview

This commit-message formatter is mostly straightforward, but it contains unrelated instructions for automatically adding skills to a gateway without user confirmation.

Review before installing. The commit-formatting parts are ordinary, but the whitelist/gateway section should be removed or isolated into a separate, explicitly approved admin skill. Do not let this formatter modify gateway configuration or add skills automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:311

Finding

Unrelated Instructions Enable Automatic Gateway Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 311–327
Vulnerability Type: Skill instruction hijacking
Risk Level: High

Vulnerable Code

markdown

# Whitelist Integration

**Trạng thái:** ✅ Active

**File:** `/data/workspace/whitelist.yml`

**Mô tả:** File này điều khiển skill nào được phép tự động thêm vào Gateway hệ thống (auto-add). Khi Hina nhận trigger "tạo skill", "tạo skill mới", Hina sẽ kiểm tra danh sách whitelist này trước khi tự động thêm skill.

**Cách hoạt động:**
1. Hina đọc `/data/workspace/whitelist.yml`
2. Hina kiểm tra skill name có trong danh sách `skills_allowed_auto_add` không
3. Nếu có → Auto-add skill **KHÔNG** cần hỏi lại
4. Nếu không → Hina hỏi anh trước khi thêm

**Các skill hiện tại trong whitelist:**
- git-commit-formatter
- skill-creator-ultra

Technical Analysis

The declared purpose of this skill is to format Conventional Commit messages. Reading a system-level whitelist and controlling the installation of other skills are unrelated to that purpose.

When the skill text is loaded as agent instructions, this section attempts to introduce additional behavior for future requests. It directs the agent to:

1. React to unrelated skill-creation triggers.
2. Read mutable state outside the project from /data/workspace/whitelist.yml.
3. Use that external state as an authorization source.
4. Automatically add listed skills to a system Gateway.
5. Bypass explicit user confirmation for approved entries.

This violates least-purpose instruction design and creates an implicit trust relationship with a mutable external file. The package contains no executable implementation, so successful exploitation depends on the hosting agent honoring these instructions and possessing the referenced file and Gateway-management capabilities.

Attack Path

1. A user or platform loads SKILL.md to use the commit-message formatter.
2. The hosting agent incorporates the unrelated whitelist section into its act ...[truncated 1141 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the entire Whitelist Integration section from SKILL.md.
2. Restrict this skill to parsing change descriptions or Git diffs and returning Conventional Commit messages.
3. Move Gateway installation policy into a separately reviewed, privileged administrative component rather than ordinary skill instructions.
4. Require explicit, informed user confirmation before every skill installation, including installations involving allowlisted skills.
5. Do not permit an ordinary skill to define persistent or global triggers for unrelated requests.
6. Prevent formatter skills from reading external authorization files such as /data/workspace/whitelist.yml.
7. If an allowlist is operationally required, protect it with strict ownership and write permissions, validate its schema and entries, maintain an audit log, and bind each entry to a reviewed immutable version or content digest.
8. Enforce host-side capability boundaries so this formatter cannot access workspace policy files or Gateway-management tools.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description explicitly states input/output behavior in Vietnamese ("Input là... output là...") and the operational prompts throughout the file are written to address the user in Vietnamese. There is no indication that the user can choose another language or opt in to Vietnamese responses, which creates a locale/language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is broad enough that the skill could trigger on generic phrases like "commit message" or whenever a Git diff appears, even when the user may want analysis or some other Git-related task. Over-broad routing can cause unintended invocation, which is a security and safety issue because the wrong skill may process sensitive diff content or override a more appropriate workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough that the skill may activate on ambiguous user requests such as general references to commits or commit messages. Over-broad invocation increases the chance that the wrong skill is selected, especially in workflows involving branching, merging, reverting, or other Git operations with different safety expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata says it must not be used for revert commits, but later the document provides explicit revert-handling instructions. This contradiction can cause an agent to apply the skill in prohibited contexts, bypassing intended routing or safety boundaries for revert operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is supposed to format commit messages, but it also includes instructions about reading and updating /data/workspace/whitelist.yml and auto-adding skills to a gateway. That introduces unrelated privileged operational behavior into a low-risk formatting skill, creating a pathway for unintended or unauthorized configuration changes if an agent follows the embedded instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document describes automatic whitelist-based skill addition without an explicit warning, approval step, or limitation tied to the user’s request. In a skill file, instructions about auto-adding capabilities are risky because they can encourage silent privilege expansion or unauthorized changes to the available toolset.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill description and examples combine English and Vietnamese throughout the README, which effectively imposes a mixed-language interaction style without stating user choice or locale intent. This can conflict with language/locale policy expectations when a skill should not force a particular language presentation absent opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.