git-workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.5

Overview

The main skill file is cautious, but the package also includes conflicting release scripts and documentation that can change and publish repository history.

Review carefully before installing. The safest path is to remove or split out the release scripts and legacy release documentation, leaving only the narrow SKILL.md and README template behavior. Do not run the bundled release scripts unless you intend to grant repository publish authority and have branch protections, backups, and human approval in place.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/release.bat:24

Finding

Command Injection Through Unvalidated Arguments in the Windows Release Script

Content

View full analysis

nul 2>&1 git checkout -b %RELEASE_BRANCH% ``` Feature branch arguments are similarly inserted into a batch loop and Git commands: ```bat set "FEATURE_BRANCHES=%~1" for %%i in (%FEATURE_BRANCHES%) do ( git rev-parse --verify %%i >nul 2>&1 if errorlevel 1 ( call :print_error "Branch %%i does not exist" exit /b 1 ) call :print_info "Merging branch: %%i" git merge --no-ff %%i -m "Merge feature branch: %%i" ) ``` Release operations reuse the same unvalidated value in merge, tag, push, and deletion commands: ```bat set "RELEASE_BRANCH=release/%VERSION%" git merge --no-ff %RELEASE_BRANCH% -m "Release version: %VERSION%" if "%CREATE_TAG%"=="true" ( git tag -a "v%VERSION%" -m "Release version: %VERSION%" git push origin "v%VERSION%" ) git branch -d %RELEASE_BRANCH% git push origin --delete %RELEASE_BRANCH% ``` ### Technical Analysis Windows batch files parse metacharacters such as `&`, `|`, `<`, `>`, `(`, and `)` as command syntax. The script accepts version and feature-branch values directly from command-line arguments and later expands them into unquoted command positions. Quoting the initial `set` assignment does not make la ...[truncated 1873 chars]

Remediation

View remediation

`, `^`, `%`, `!`, `(`, and `)`. 4. Do not construct a whitespace-separated branch list and reparse it with `for %%i in (...)`. 5. Avoid passing user-controlled expanded text through `call`. 6. Quote every Git argument and use `--` before positional refs where the Git subcommand supports it. 7. Check the exit status after every checkout, pull, merge, tag, push, and delete operation; stop immediately on failure. 8. Prefer implementing the release utility in a language that starts subprocesses with argument arrays rather than command strings, such as Python or PowerShell using structured process invocation. 9. Require an explicit preview and confirmation before pushing or deleting remote refs. 10. Add security tests covering spaces, wildcard characters, option-like values, and all Windows command metacharacters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/release.sh:121

Finding

Unsafe Git Argument Handling in the Unix Release Script

Content

View full analysis

/dev/null 2>&1; then print_error "Release branch $release_branch already exists" exit 1 fi git checkout -b $release_branch ``` Feature branch arguments are also used without validation, quoting, or an option terminator: ```bash local feature_branches=("$@") for branch in "${feature_branches[@]}"; do if git rev-parse --verify $branch > /dev/null 2>&1; then print_info "Merging branch: $branch" git merge --no-ff $branch -m "Merge feature branch: $branch" else print_error "Branch $branch does not exist" exit 1 fi done ``` The same pattern appears in branch creation and publishing operations: ```bash if git rev-parse --verify $branch > /dev/null 2>&1; then print_warning "Branch $branch already exists; skipping creation" else git checkout -b $branch fi ``` ```bash if ! git rev-parse --verify $release_branch > /dev/null 2>&1; then print_error "Release branch $release_branch does not exist" exit 1 fi git merge --no-ff $release_branch -m "Release version: $version" ``` ```bash git branch -d $release_branch if git remote -v | grep -q "origin"; then git push origin --delete $release_branch fi ``` ### Technical Analysis Unquoted shell variable expansion is subject to word splitting and pathname expansion. A single supplied argument can therefore become multiple arguments or expand to filesystem entries when passed to Git. Branch arguments are not validated with `git check-ref-format`. Values beginning with `-` may also be interpreted as Git option ...[truncated 2042 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/test-release.sh:12

Finding

Predictable Temporary Directory Allows Local Filesystem Manipulation

Content

View full analysis

README.md git add README.md git commit -m "Initial commit" ``` ### Technical Analysis The temporary directory name is derived only from the current timestamp with one-second precision. On a multi-user system, another local user can predict the path that will be used. The script calls `mkdir -p`, which succeeds when the target directory already exists instead of requiring exclusive creation. The script does not verify that the directory was newly created, that it is owned by the invoking user, or that it has restrictive permissions. After entering the directory, the script writes fixed filenames with output redirection. If an attacker pre-creates the directory and places attacker-controlled filesystem objects inside it, the victim may operate in an untrusted location. In environments where symbolic-link protections do not prevent the relevant operation, a prepared link can redirect a file write to another file accessible to the victim. ### Attack Path 1. A local attacker predicts the timestamp-based `/tmp/pms-pc-test-YYYYMMDDHHMMSS` path. 2. Before the victim runs the script, the attacker creates that path or arranges for it to resolve to an attacker-controlled directory. 3. The attacker places crafted files or symbolic links such as an attacker-controlled `README.md` entry inside the directory. 4. The victim starts `test-release.sh` during the predicted second. 5. `mkdir -p` accepts the existing path, and `cd` enters it without ownership or permission checks. 6. Subsequent redirects and Git operations affect attacker-prepa ...[truncated 876 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (155)

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The document includes a remote branch deletion command (git push origin --delete), which is well outside the skill's allowed capabilities and affects shared repository state for all collaborators. In an agent context this is especially severe because it can cause immediate loss of coordination, disrupt active work, and violate the manifest's safety boundary around destructive and remote operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The rollback guidance includes hard resets and force-pushes to main and dev, which rewrite local and remote history and can irreversibly discard collaborators’ commits. In this skill context, that is especially dangerous because the manifest explicitly disallows history rewriting, so the documentation undermines the stated safety model while presenting highly destructive commands as routine troubleshooting.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

该脚本实际实现了创建发布分支、合并功能分支、发布到 main、打 tag、推送远程以及删除远程分支等高影响 Git 操作，明显超出技能元数据声明的“轻量工作流助手”权限范围。若该技能被用户或上层代理按声明信任并调用，可能在缺乏充分预期的情况下直接修改仓库历史与远程状态，造成供应链与发布流程风险。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script implements a full release pipeline, including release branch creation, merging, publishing to main, tagging, pushing to remote, and branch deletion prompts. This directly contradicts the skill's declared scope, which only permits README managed-block updates and, with confirmation, local feature branch creation; such capability mismatch is dangerous because an agent or user invoking this skill could trigger destructive repository state changes far beyond the advertised trust boundary.

Content

No source excerpt is available for this finding.

Scope Creep

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs Git history-changing operations such as checkout, pull, merge, tag, push, and branch deletion handling, all of which exceed the manifest's allowed operations. In the context of an ostensibly constrained workflow helper, this creates a privilege-escalation path where the skill can modify repository history and synchronize changes remotely despite policy stating those actions are forbidden.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The rollback instructions use git reset --hard and git push --force on main and dev, directly contradicting the skill metadata prohibition on history rewriting and dangerous remote operations. These commands can destroy commits, overwrite collaborators' history, and cause immediate integrity and availability impact across the repository and downstream deployment processes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README presents the skill as implementing a full Git Flow lifecycle, including release and publish activities, while the declared skill scope explicitly forbids commit, merge, push, tag, release, and history-changing actions. This kind of scope drift is dangerous because users or downstream agents may trust the README over the manifest and invoke repository-modifying operations that exceed intended authority.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These documented capabilities explicitly include integration testing merges, release testing, formal release, and issue-handling workflows that imply privileged Git operations outside the allowed behavior. In skill ecosystems, capability documentation materially affects agent behavior, so overstating powers can lead to unsafe execution paths and unauthorized repository state changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The usage scenarios instruct users to create release and hotfix branches and to proceed through merge-selection flows, directly contradicting the declared restriction that only local feature-branch creation is permitted. This is especially risky in an agent context because examples are often treated as normative behavior and can train or prompt unsafe actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The command examples include git merge, git push, and git tag, which are exactly the classes of repository-modifying and publication actions the manifest forbids the skill from performing. Publishing these commands as part of the skill workflow creates a high risk that users or consuming agents will execute destructive or unauthorized changes under the skill’s apparent authority.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README advertises bundled release, test, and branch-management scripts that support publishing workflows beyond the skill’s allowed scope, including release creation and tag-based publication. Referencing such scripts from the skill documentation expands the perceived attack surface and may cause an agent or user to invoke unsafe automation not covered by the manifest’s restrictions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

描述中允许的核心能力之一是“创建 feature 分支”，这与脚本主要用途基本一致；脚本也没有执行 commit、stash、rebase、merge、push、tag、发布、删除分支或历史重写。但描述明确强调“只允许……经确认后创建本地 feature 分支”，而实际代码在创建前会在检测到 origin 时主动执行 git pull origin <base_branch>，这属于远程同步/更新行为，不再是纯本地分支创建。虽然 git pull 通常由 fetch+merge/rebase 组成，代码未显式声明 rebase，但它确实进行了未声明的同步操作，违反了“仅本地创建”及“不写入或同步 README 工作流之外的同步限制”的表述。此外，脚本会自动 checkout 到基础分支并 checkout -b 到新分支，属于会改变当前工作树/HEAD 状态的写操作；这可视为创建分支的配套行为，本身不一定构成问题。真正的实质性偏差在于未声明的远程拉取能力，因此应判定为描述与实际行为不完全一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明强调的是一个受限的轻量 Git 工作流助手，能力集中在 README 工作流写入/同步、feature 分支创建和状态检查，并特别限制操作范围。实际代码并不处理 README，也不做状态检查；其核心功能是创建 hotfix 分支。更重要的是，脚本在创建分支前会切换基础分支并在检测到 origin 时执行 git pull，这属于远程同步行为，明显超出“仅允许更新 README 托管区块和经确认后创建本地 feature 分支”的范围。虽然代码没有执行 commit、merge、push 等被禁止操作，但其主用途和具体能力都与声明存在实质偏差，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is a limited Git workflow helper restricted to README workflow synchronization, local feature branch creation with confirmation, and status checks, while explicitly prohibiting commit, merge, push, tag, release, and branch deletion behaviors. The supplied code instead configures a release automation workflow, including merge policies, release commit messages, auto-tagging, auto-push, release branch handling, and rollback capabilities. Even though this chunk is a configuration file rather than the executor itself, it clearly enables and describes capabilities that are materially broader and directly contrary to the declared constraints. Therefore the description does not accurately represent the code's actual behavior/purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述将该技能限定为 README 工作流辅助工具，能力范围非常窄，并且明确排除了 merge、push、tag、发布和分支删除等高风险 Git 操作。实际代码却以“自动化发布脚本”为核心，主要功能是创建 release 分支、合并功能分支、发布到 main、同步回 dev、创建标签、推送远程以及可选删除发布分支。这不是对声明功能的轻微扩展，而是主目的和能力边界都发生了根本性变化。虽然代码也包含“创建功能分支”和“显示状态”等与声明局部相似的动作，但整体行为明显超出且直接违反声明中的限制，因此构成明确的不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

代码的主要目的与声明明显不符。声明强调这是一个受限的 Git 工作流助手，仅允许有限的 README 更新、状态查看和经确认的本地 feature 分支创建，且明确不执行 commit、merge、tag、发布等操作。实际代码却是一个独立的测试发布环境搭建脚本，会新建仓库、创建和切换多个分支、写入文件、提交多次更改，并执行多次 merge，这些都属于声明中明确禁止或未声明的能力。此外，脚本最终还提示测试 release.sh 的发布命令，表明其核心用途是为发布流程测试提供环境，而不是实现所声明的轻量工作流助手功能。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- 不在 `SKILL.md` 内维护第二份 README 工作流正文。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document describes a full release automation workflow including merge, publish, tag, branch deletion, rollback, and force-push operations, which materially exceeds the skill's declared lightweight scope. In an agent setting, this mismatch can cause the skill or its operator to over-trust documentation and invoke destructive Git behaviors that the skill explicitly says it should never perform.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

git reset --hard discards working tree and index changes and moves branch history, making accidental data loss likely. Within an agent-skill context, inclusion of this command is especially risky because it normalizes destructive state changes that the declared skill should never automate or encourage.

Content

Scanner excerpt · docs/RELEASE_SCRIPT_USAGE.md (reported line 168)May include surrounding context.

bash

# 回滚到指定版本
git checkout main
git reset --hard v1.1.0  # 回滚到v1.1.0
git push origin main --force

# 同时回滚dev

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The documented use of git push origin main --force rewrites the remote main branch and can erase or orphan collaborators' commits. In the context of a skill that is supposed to avoid push and history-rewrite actions, documenting this exact command increases the chance that an operator or agent will perform a prohibited, high-impact action.

Content

Scanner excerpt · docs/RELEASE_SCRIPT_USAGE.md (reported line 169)May include surrounding context.

md

# 回滚到指定版本
git checkout main
git reset --hard v1.1.0  # 回滚到v1.1.0
git push origin main --force

# 同时回滚dev
git checkout dev

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

A second git reset --hard is documented for the dev branch, extending the same destructive rollback pattern to another shared integration branch. This broadens blast radius by risking loss of unpublished work and destabilizing the development branch relied on by other team members and automation.

Content

Scanner excerpt · docs/RELEASE_SCRIPT_USAGE.md (reported line 173)May include surrounding context.

同时回滚dev

git checkout dev git reset --hard v1.1.0 git push origin dev --force

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/superpowers/plans/2026-08-11-lightweight-git-workflow-assistant.md (reported line 169)May include surrounding context.

powershell

$skill = 'C:\Users\wangyikan\.agents\skills\git-workflow\SKILL.md'
(Get-FileHash -LiteralPath $skill -Algorithm SHA256).Hash
rg -n --no-heading '^### [1-6]\.|发布上线|紧急修复|部分发布|git push|git merge --squash|git reset --hard' $skill

Expected: 输出当前文件哈希，并能找到旧版 dev、release、hotfix、cherry-pick、push 或历史重写流程。该结果用于证明后续确实移除了执行型工作流。

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The plan authorizes writes outside the declared scope by creating and later deleting a separate workspace under Documents\Codex\...\work\git-workflow-smoke, while the manifest says the skill only updates README managed blocks and may create a local feature branch after confirmation. Scope expansion like this is dangerous because it normalizes arbitrary filesystem modification and deletion beyond the user’s project and beyond the manifest’s promised boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide materially exceeds the skill's declared scope by teaching hotfix/release branching, merge operations, and remote sync actions even though the manifest says the skill must only assist with README workflow updates, local feature branch creation, and status checks. In an agent setting, this mismatch can induce unsafe or unauthorized Git operations that users and orchestrators explicitly rely on the manifest to prevent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Including git pull and git push instructions conflicts directly with the declared restriction against remote synchronization. If an agent or user follows this guide, it can change local state based on remote content or publish changes externally, violating least privilege and creating risk of unintended data propagation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.