Git Helper

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a simple Git command helper with no code, but it references an unprovided git-helper command and includes operations that can change local or remote repositories.

This skill appears purpose-aligned and does not include executable code, but verify that any git-helper command is trusted and ask the agent to confirm repository, branch, remote, and intent before running pull, push, or branch-changing commands.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If used on the wrong repository, branch, or remote, the agent could pull unwanted changes or push commits to a shared repository.

Why it was flagged

The skill documents Git operations that can change the local working tree, branch state, or remote repository when used.

Skill content

git-helper pull

git-helper push

git-helper branch

Recommendation

Use these commands only after confirming the repository, branch, remote, and intended action, especially before push or branch-changing operations.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The documented wrapper may fail, or an agent might run a git-helper executable from the user's PATH whose implementation was not reviewed as part of this skill.

Why it was flagged

The skill provides no install step and declares only git as required, but its command examples call git-helper, which is not included in the provided files.

Skill content

No installation needed. `git` is always present on the system.

Recommendation

Verify what git-helper resolves to before use, or prefer direct trusted git commands unless the skill provides and declares a reviewed wrapper.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill may act with whatever repository access the user's Git setup already has.

Why it was flagged

Pull and push operations commonly use the user's existing Git credentials, SSH keys, or credential helper configuration even though no explicit credential is declared.

Skill content

git-helper pull

git-helper push

Recommendation

Confirm the target remote and account before allowing pull or push operations, and avoid using this in repositories where the agent should not have write access.