Security audit

batch-git-url-replace

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it can bulk-edit Git repository settings and its command templates handle user inputs unsafely.

Install only if you understand that it may modify many Git repositories at once. Use a narrowly scoped directory, review the generated commands before running them, avoid untrusted URL/path inputs, and prefer a safer implementation using Git commands like `git remote get-url` and `git remote set-url` with a dry run and backup.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:26
Finding: PowerShell Command Injection Through Unescaped Parameter Interpolation
Content: View full analysis
" $oldUrl = "" $newUrl = "" ``` ### Technical Analysis The Skill instructs the agent to replace these placeholders directly with user-provided values before executing the PowerShell script. The values are inserted into double-quoted PowerShell string literals without escaping or validation. An attacker-controlled value can contain a double quote to terminate the intended string, followed by arbitrary PowerShell statements. Because the resulting content is treated as PowerShell source code, the injected statements execute with the privileges of the user or agent running the generated script. All three parameters—`scanDir`, `oldUrl`, and `newUrl`—are affected. Merely validating that a value resembles a path or URL is insufficient unless validation is strict and values are passed separately from executable source code. ### Attack Path 1. The Skill asks the user for a scan directory, old URL, and new URL. 2. An attacker supplies a value containing a closing quote and additional PowerShell syntax. 3. The agent substitutes the value directly into one of the assignments. 4. The user or agent executes the generated PowerShell script. 5. PowerShell parses the injected content as commands. 6. The attacker's commands run with the privileges of the process executing the script. ### Impact Assessment Successful exploitation provides arbitrary command execution under the current user's security context. Depending on that user's privileges, an attacker could read or modify files, access credentials available to the process, alter repositories beyond the requested scope, install software, or establish persistence. The Skill does not itself obtain elevated privileges, but exploitation inherits all permissions already held by the invoking process. ...[truncated 4 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:69
Finding: Bash Command Injection Through Unescaped Parameter Interpolation
Content: View full analysis
" OLD_URL="" NEW_URL="" ``` ### Technical Analysis The Bash template places user-provided values directly inside double-quoted shell assignments. Double quotes do not disable command substitution in Bash. Consequently, input containing constructs such as `$(...)` or backticks is evaluated when the generated script runs. An input containing an unescaped double quote can also terminate the assignment and introduce additional shell syntax. The issue affects every required parameter and results from generating shell source through direct textual interpolation. ### Attack Path 1. The Skill requests `scanDir`, `oldUrl`, and `newUrl`. 2. An attacker supplies a value containing shell command substitution or syntax that terminates the quoted assignment. 3. The agent inserts the value into the Bash template without shell-safe encoding. 4. The generated script is executed. 5. Bash evaluates the command substitution or injected shell statements. 6. Arbitrary commands run with the invoking user's privileges. ### Impact Assessment An attacker can execute arbitrary operating-system commands within the security context of the agent or user running the script. This may expose source code, SSH keys, Git credentials, environment variables, and other files accessible to that account. It may also permit modification of unrelated repositories, deletion of data, malware installation, or persistence if the invoking account has sufficient permissions. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:81
Finding: Regex and Sed Program Injection in Git Configuration Replacement
Content: View full analysis
/dev/null; then sed -i "s|${OLD_URL}|${NEW_URL}|g" "$config" ``` ### Technical Analysis `OLD_URL` is passed to both `grep` and `sed` as a regular expression rather than as a literal string. Regex metacharacters in a URL can therefore match content other than the exact old URL. `NEW_URL` is inserted directly into the `sed` replacement field. Characters such as `&`, backslashes, the `|` delimiter, and newlines have special meanings in a `sed` replacement or program. This can produce incorrect replacements, malformed Git configuration, or injected `sed` instructions. In environments supporting executable `sed` commands, sufficiently crafted program injection may lead to command execution. The `grep` condition and `sed` replacement also use different interpretations of the same untrusted value, making it possible for the test to approve a file while the subsequent operation changes unintended content. ### Attack Path 1. An attacker supplies an old URL containing regular-expression metacharacters or a new URL containing `sed` replacement/program metacharacters. 2. `grep` interprets the old URL as a regex and may identify configurations that do not contain the exact literal URL. 3. `sed` interprets the old URL as a regex and the new URL as replacement or program syntax. 4. The command alters unintended portions of each matching `.git/config` file or fails after partially processing repositories. 5. If control characters and implementation-specific executable `sed` commands are accepted, crafted input may extend the `sed` program and execute commands. ### Impact Assessment The direct impact is loss of integrity across every discovered Git repository beneath the selected scan directory. Remote URLs ...[truncated 402 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language content of the skill, including its description, parameters, and execution guidance, is entirely in Chinese. Under the policy, forcing a specific language without offering the user a choice or documenting a justified locale constraint is a language policy violation.
Content: No source excerpt is available for this finding.