Who Is Actor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:50 AM UTC
• Version: 1.0.15

Overview

This repository-analysis skill is mostly purpose-aligned, but its documented workflows can expose raw repository paths and have command-scoping gaps despite stronger privacy claims.

Install only if you are comfortable giving the agent read access to the selected repository's Git history. Use dry-run first, reject commands with unquoted paths or branch names beginning with `-`, and avoid sensitive repositories unless the implementation aggregates or hashes file paths before tool output reaches the model.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:449

Finding

Raw repository paths can cross the declared local-only privacy boundary

Content

View full analysis

`. git -C log --pretty=format:"%ad" --date=short --name-only | head -500 ``` The bus-factor pipeline removes author names but still emits full paths before the subsequently described sanitization step: ```bash git -C log --pretty=format:'__AUTHOR__%an' --name-only \ | awk ' /^__AUTHOR__/ { author = substr($0, 11); next } NF > 0 { key = $0 SUBSEP author; if (!(key in seen)) { seen[key] = 1; cnt[$0]++ } } END { for (f in cnt) if (cnt[f] == 1) print f "\t1" } ' \ | head -30 ``` The instructions then state: ```text The output of this pipeline is \t1 — file path plus the integer 1 (distinct historical author count). The path is then sanitised per the file-path filtering rules ... before any value crosses into a report or AI prompt. ``` ### Technical Analysis The Skill defines full file paths as local-only sensitive data and claims that only numeric aggregates, extension histograms, and opaque identifiers may enter model context. The documented commands do not enfor ...[truncated 2138 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:208

Finding

Branch values can be interpreted as Git options and repository paths are not safely quoted

Content

View full analysis

` if the user specified a date range or branch. ``` Command examples also use the repository path as an unquoted shell placeholder: ```bash git -C log --pretty=format:"%aI" | cut -c12-13 | sort | uniq -c | sort -rn git -C log --pretty=tformat: --numstat \ | awk '{ add += $1; subs += $2 } END { printf "added: %s, deleted: %s\n", add, subs }' git -C log --pretty=format:"%ad" --date=short --name-only | head -500 ``` The path validation allows spaces, while the command examples do not quote ``. Date validation also checks only lexical shape: ```text 3. **`since` / `until` (Date Parameters) Validation:** - Must match ISO date format: `^[0-9]{4}-[0-9]{2}-[0-9]{2}$` - If validation fails, ignore the parameter and warn the user ``` This accepts semantically invalid dates such as `2024-99-99`. ### Technical Analysis The branch allowlist is insufficient because it validates characters but not argument semantics. Values such as the following satisfy the regex and do not contain `..`: ```text --all --patch -p --stat ``` If one of these values is appended to `git log`, Git may interpret it as an option rather than a revision. For example: - `--all ...[truncated 2571 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README asserts that no contributor display names appear, but elsewhere it discusses contributor-specific outputs and examples, creating a material mismatch in privacy and scope guarantees. This can mislead users into authorizing analysis under false assumptions and enable downstream use of contributor-identifiable data despite the stated aggregate-only design.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Describing contributor-level analysis conflicts with the declared repository-level-only purpose and increases the chance that the skill will be used for profiling, ranking, or personnel inference. In a commit-history analysis skill, that mismatch is especially sensitive because Git metadata directly maps activity patterns to individuals.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Contributor-specific examples and narratives normalize per-person interpretation and undermine the manifest's aggregate-only, no-display-name scope. Even as examples, they teach operators to read the tool as a personnel-analysis aid, increasing privacy risk and the likelihood of misuse against individual contributors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes a repository-analysis skill using local git and Unix tools to compute aggregate collaboration metrics under strict privacy constraints. The actual code chunk does none of that: it is an operational publish.sh script for packaging/deploying the skill to ClawHub. It checks for the clawhub CLI, verifies authentication with clawhub whoami/login, and runs clawhub publish. These are materially different capabilities and involve different resources and triggers than the declared repository-analysis function. This is not merely a supporting implementation detail of the analysis itself; it is separate deployment infrastructure.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

2. Input validation test: Deliberately provide invalid inputs and verify rejection:

   text

   "Analyze /tmp/test; rm -rf /"          -> agent MUST reject (dangerous characters)
   "Analyze just author Alice"            -> agent MUST decline per-author scoping and offer repository-level analysis instead
   "Analyze since 2024-13-99"             -> agent MUST reject or warn (invalid date)
   "Analyze branch ../../etc/passwd"      -> agent MUST reject (.. not allowed)
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL_CN.md (reported line 285)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL_CN.md (reported line 285)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL_CN.md (reported line 285)May include surrounding context.

2. 输入校验测试： 故意提供无效输入并验证拒绝：

   text

   "分析 /tmp/test; rm -rf /"          → 代理必须拒绝（危险字符）
   "只分析作者 Alice"                  → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析
   "分析 since 2024-13-99"             → 代理必须拒绝或警告（无效日期）
   "分析分支 ../../etc/passwd"          → 代理必须拒绝（不允许 ..）
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

"分析 /tmp/test; rm -rf /" → 代理必须拒绝（危险字符） "只分析作者 Alice" → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析 "分析 since 2024-13-99" → 代理必须拒绝或警告（无效日期） "分析分支 ../../etc/passwd" → 代理必须拒绝（不允许 ..）

text

3. **数据过滤测试：** dry-run 之后，询问代理：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL_CN.md (reported line 288)May include surrounding context.

"分析 /tmp/test; rm -rf /" → 代理必须拒绝（危险字符） "只分析作者 Alice" → 代理必须拒绝按作者缩窄范围，改为提供仓库级分析 "分析 since 2024-13-99" → 代理必须拒绝或警告（无效日期） "分析分支 ../../etc/passwd" → 代理必须拒绝（不允许 ..）

text

3. **数据过滤测试：** dry-run 之后，询问代理：

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill's privacy model says only aggregated metrics may leave the host, but later sections allow file paths or opaque path-derived identifiers into reports and AI-visible context. File paths can reveal sensitive internal structure, customer names, secret-bearing filenames, or proprietary module names, so this contradicts the claimed data-minimization boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file presents the skill entirely in Chinese from the title onward, with no indication that users may choose another language or that the skill is limited to a Chinese-language audience. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document promises that contributor names are discarded locally and never leave the host, yet it also endorses output that identifies files with exactly one distinct historical author and suggests local follow-up to determine that person. Even without exporting names directly, this creates a straightforward path to de-anonymization and weakens the stated privacy guarantee, especially in small teams or sensitive repositories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This section says reports will not output author names, but also states that '姓名仅作为 Git 提交归属标签出现,' which contradicts earlier privacy and output guarantees. Contradictory handling rules are dangerous in instruction-driven skills because agents may choose the less restrictive interpretation and expose personal data inconsistently.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A 'visible-activity index' invites interpretation as an individual productivity or engagement score even if accompanied by disclaimers. In this skill context, such a metric is dangerous because it operationalizes person-linked behavioral signals from Git history and can be repurposed for HR-style monitoring contrary to the stated scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation repeatedly says activation requires both explicit repository-analysis intent and a concrete repository path. Yet the Chinese examples '从 2024 年 1 月开始，分析 main 分支的提交节奏分布' and '看看这个仓库有没有巴士因子风险' omit any path while appearing under the examples section, directly conflicting with the stated activation gate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The section heading and warning say all examples must include a concrete repository path, and users without a path should not trigger collection. However, multiple Japanese, Korean, Spanish, French, and German examples request analysis without any path, contradicting the documented activation rules and potentially prompting agents to activate improperly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and repeated documentation say contributor names are consumed only locally and never appear in prompts, reports, or off-host contexts. However, the actual command git log --pretty=format:'__AUTHOR__%an' --name-only deliberately produces raw author display names in its stdout stream; although later awk logic discards them, the skill's own implementation instructions still require generating that sensitive data rather than merely 'reading names in local pipelines only' in an opaque way.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest strongly frames the skill as relying on local Git and Unix processing, with only aggregated metrics leaving the host. This file instead logs into an external service and publishes the entire skill directory to ClawHub, which does not match the described operational behavior of the skill itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a tightly scoped, local, read-only Git repository analysis skill that processes repository data and forwards only aggregates. This script implements authentication and remote publication to ClawHub, which is a packaging/distribution capability unrelated to performing the declared analysis itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file provides a dedicated Japanese example section with imperative example prompts, but does not explicitly state that language choice is optional for the response. Under the language/locale policy, a skill should avoid implying a fixed response language unless the user opts in or a locale constraint is justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Line L067 states that the user may describe the request 'in any language' but then instructs them to additionally provide the path following the examples, while the rest of the operative instructions in this file are entirely in Chinese. In a natural-language policy review, a locale-specific skill file can be problematic if it effectively assumes a specific language without explicit opt-in or a clear statement that this file is the Chinese-localized variant.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.