Security audit

Commit Helper

Security checks for vulnerabilities and agentic risk

Overview

The package contains a real commit-message helper, but it also ships an undisclosed local data-storage utility and prints unsafe copy-and-run git commands.

Review before installing. Use only the documented cz_cli.sh interface with trusted commit text, avoid copy-pasting generated git commands that contain untrusted quotes or shell characters, and be aware that the package includes an extra script that can persist and export local user-supplied data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cz_cli.sh:20
Finding: Shell Command Injection Through Unsafe Copy-and-Run Command Generation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:5
Finding: Undocumented Plaintext Persistence of User-Supplied Arguments
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` The logging function is called by commands throughout the script: ```bash cmd_run() { echo " Running: $1" _log "run" "${1:-}" } cmd_config() { echo " Config: $DATA_DIR/config.json" _log "config" "${1:-}" } cmd_status() { echo " Status: ready" _log "status" "${1:-}" } cmd_init() { echo " Initialized in $DATA_DIR" _log "init" "${1:-}" } cmd_list() { [ -f "$DB" ] && cat "$DB" || echo " (empty)" _log "list" "${1:-}" } cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" } cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } cmd_search() { grep -i "$1" "$DB" 2>/dev/null || echo " Not found: $1" _log "search" "${1:-}" } cmd_export() { [ -f "$DB" ] && cat "$DB" || echo "No data" _log "export" "${1:-}" } ``` ### Technical Analysis The script creates a persistent data directory immediately upon startup. Most commands append their first argument to `history.log`, while `cmd_add` writes all supplied arguments to `data.log`. No warning identifies arguments as persistently logged, no filtering or redaction is performed, and no restrictive file-creation permissions are explicitly established. Consequently, confidential text accidentally supplied as an argument may remain on disk after execution. Whether another local account can read the files depends on the user's effective `umask`, parent-directory permissions, and operating-system access controls. This behavior is also not disclosed by `SKILL.md`, which document ...[truncated 1349 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is a Commitizen/cz-cli conventional commit helper. However, the code implements a multi-purpose local utility with generic CRUD-like commands and logging to files under a user data directory. There is no evidence of interacting with git commits, generating conventional commit messages, invoking cz-cli, enforcing commit conventions, or providing commit-helper behavior specific to Commitizen. The primary purpose is materially different from the declared one, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's behavior materially diverges from the declared skill purpose: instead of helping generate conventional commits, it implements a generic local datastore with add/list/search/export operations and persistent logging. In an agent-skill context, this kind of capability mismatch is dangerous because it can cause users or orchestrators to invoke the tool under false pretenses, leading to unintended data collection, retention, and exposure through export/list/history features.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline/help text explicitly presents the tool as a 'Multi-purpose utility tool,' which contradicts the published identity of a Commitizen helper. This inconsistency is a security-relevant transparency failure: in a skill ecosystem, misleading documentation can conceal broader capabilities and make it easier for a repurposed tool to collect or expose data outside user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The logging helper appends user-influenced command data to a persistent history file without clearly informing the user that inputs are being retained on disk. While not code execution, this creates a privacy and data-handling risk because prompts, identifiers, or sensitive text passed as arguments may be stored and later disclosed via local access or backups.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The add command writes arbitrary user-supplied content directly into a persistent data file without warning, consent, or retention controls. In the context of a purported commit helper, this is unexpected behavior and can lead to inadvertent local storage of sensitive content, especially if users supply commit text, issue references, or other internal project details.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.