Security audit

git-workflow

Security checks across malware telemetry and agentic risk

Overview

The main skill instructions are restrictive, but the package also contains contradictory Git release, merge, push, tag, and deletion guidance and scripts that could affect shared repositories if used.

Review this skill before installing. The safe runtime instructions are in SKILL.md and templates/readme-git-workflow.md, but the package includes legacy docs and scripts that should not be used by an agent for releases, merges, pushes, tags, rebases, resets, or branch deletion. Prefer installing only after those files are removed or clearly separated from the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (94)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The README expands the skill from a narrowly scoped helper into a full Git Flow assistant that includes release and integration actions outside the manifest’s allowed behavior. In an agent setting, this kind of documentation/behavior drift is dangerous because users or downstream orchestration may rely on the README and trigger destructive repository operations the manifest explicitly forbids.

Description-Behavior Mismatch

Critical

Confidence: 100% confidence
Finding: This section directly documents merge-to-dev, merge-to-release, merge-to-main, tagging, and push commands, all of which contradict the declared safety boundary. If an agent follows or surfaces these instructions as part of skill execution, it could modify protected branches, create releases, and publish changes to remotes, causing immediate integrity and release-process impact.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README advertises hotfix workflow support and hotfix branch creation, which exceeds the manifest’s limited allowance of confirmed local feature-branch creation. Even if framed as guidance, this broadens the implied operational scope and can lead an agent or user to perform urgent production-affecting branching actions that were never authorized.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: Documenting release, publish-with-tag, test-release, and hotfix-branch scripts signals the presence of operational capabilities far beyond the allowed scope. In a skill ecosystem, references to bundled scripts can encourage direct invocation by an agent or operator, leading to unauthorized repository changes, release actions, or environment manipulation.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The top-level claim that this is a complete implementation covering development through release materially contradicts the manifest’s explicit prohibition on merge, push, tag, and release actions. This is dangerous because high-level positioning shapes operator trust and agent behavior; a misleading capability statement can normalize unsafe use of the skill outside its approved boundaries.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file documents release creation, branch merging, publishing, tagging, and related operational workflows that exceed the skill’s declared scope of only README workflow updates and confirmed local feature-branch creation. In an agent setting, this kind of out-of-scope guidance is dangerous because it can steer operators or downstream automation toward privileged Git actions the skill is explicitly not supposed to perform.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: This section directly instructs prohibited Git operations including merge, tag creation, push, branch deletion, and history rewrite, contradicting the skill metadata’s hard limits. Such contradictions increase the chance that a user or agent will treat the skill as authorized for destructive repository changes, leading to integrity loss or unauthorized release actions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The plan explicitly includes `commit`, `push`, and deletion of a temporary directory during smoke testing, which exceeds the declared runtime scope of a 'lightweight' assistant that should avoid state-changing Git and destructive operations. Even if confined to a temp repo, these instructions normalize broader capabilities and increase the chance that an agent or future maintainer reuses the pattern against non-test repositories.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The plan grants authority to create bare remotes, clone repositories, make commits, push, and later destroy the temporary workspace. Those capabilities are not necessary for the stated production behavior of the skill and meaningfully widen the operational footprint, creating avoidable risk if path assumptions are wrong or the procedure is copied into active workflows.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The guide expands the skill from a narrowly declared local feature-branch helper into broader branch-management guidance covering hotfix and release workflows. That mismatch is dangerous because an agent may rely on the guide rather than the manifest and begin recommending or facilitating higher-risk workflows outside its approved scope.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: This section instructs pull, push, and merge operations even though the skill metadata explicitly forbids commit/stash/rebase/merge/push and limits actions to local feature-branch creation after confirmation. If an agent follows this guide, it could perform unauthorized network syncs or history-changing operations, violating user expectations and potentially impacting shared repositories.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The troubleshooting section teaches local and remote branch deletion, including force deletion, which is outside the skill's declared permissions and can destroy work or disrupt collaborators. Because the skill is supposed to avoid branch deletion entirely, including these commands creates a clear capability drift and raises the chance an agent surfaces destructive advice.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Introducing remote push steps adds write-capability guidance to a skill described as a lightweight local workflow assistant. Even marked as optional, remote write instructions can nudge an agent into crossing the local/remote boundary and affecting shared infrastructure without matching manifest authorization.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Repository maintenance and cleanup scripts broaden the skill from minimal workflow assistance into operational repository management. In context, that increased capability is risky because cleanup tooling can have destructive side effects and encourages the agent to reference actions beyond its approved responsibilities.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The guide documents merge, push, tag, release, and branch deletion workflows that materially exceed the skill's declared scope, which explicitly says it must not perform commit, rebase, merge, push, tag, release, branch deletion, or history rewrite actions. In an agent setting, embedded operational guidance can steer the agent or users into privileged repository-changing actions that bypass the intended safety boundary, increasing the chance of unauthorized code integration or production-impacting changes.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The conflict-prevention section recommends `git rebase dev`, even though the skill metadata explicitly excludes rebase operations. This inconsistency weakens the declared control boundary and can normalize unsupported history-altering commands in an agent context, making accidental misuse more likely.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The guide recommends `git reset --hard HEAD`, a destructive history/state-reset command, despite the manifest prohibiting history rewriting. In a skill intended to be lightweight and restricted, documenting such commands undermines safety guarantees and can lead to irreversible loss of local changes or unsafe rollback behavior if followed blindly.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file references automation scripts for auto-merging feature and hotfix branches, which expands the skill from lightweight assistance into operational automation of sensitive repository actions. In practice, this can encourage unattended or under-reviewed merges that conflict with the skill's declared restrictions and amplify the blast radius of mistakes.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The reference document materially expands the skill’s effective behavior beyond its declared safety boundary by providing direct instructions for commit, merge, push, tag, branch deletion, rebase, and force-push operations. In an agent-skill context, this creates dangerous instruction drift: the model may treat the bundled reference as authorized workflow guidance and perform destructive or policy-forbidden repository actions despite the metadata claiming such actions are disallowed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises a narrow capability set, but the embedded documentation covers full release, hotfix, conflict-resolution, history-editing, and rollback workflows. This mismatch is security-relevant because LLM agents often infer permissions from nearby documentation; the broader procedures can be surfaced or followed when users ask related questions, bypassing the intended least-privilege design.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The document includes explicit history-rewrite and destructive rollback instructions such as interactive rebase, reset --hard, and git push --force. These operations can irreversibly alter commit history, destroy unmerged work, and overwrite remote state; in a constrained assistant, their presence is especially dangerous because they contradict the claimed prohibition on history rewriting.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The troubleshooting guide includes commands and workflows that exceed the skill’s declared safe scope, including branch deletion, stash, commit, merge, rebase, push, force-push, reset, and remote branch deletion. In an agent skill, bundled reference material can steer model behavior during assistance, so these instructions materially weaken the manifest’s safety boundary and can lead to destructive or unauthorized repository operations.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The file directly contradicts the skill’s documented prohibition on commit, stash, rebase, merge, push, branch deletion, and history rewriting by providing step-by-step instructions for those exact actions. This contradiction is dangerous because agents often treat in-skill references as authoritative operational guidance, increasing the chance that disallowed and destructive Git actions are recommended or performed.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The workflow guide instructs many Git operations that directly exceed the skill manifest’s stated limits, including commit, pull, rebase, merge, push, tag, and branch deletion. If an agent follows the reference document instead of the manifest, it could perform unauthorized state-changing or remote-impacting actions, violating least privilege and causing repository damage or unintended publication.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This is a direct contradiction: the surrounding skill description says the assistant must not perform certain Git actions, while the referenced guide actively prescribes those same actions step-by-step. Such conflicting instructions are dangerous because an automated agent may resolve ambiguity unsafely and execute the more detailed operational commands.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.