Is skills/git-pushing safe?
The git-pushing skill presents moderate-to-significant risk primarily through its smart_commit.sh script, which unconditionally runs 'git add .' followed by 'git push', creating an inadvertent or deliberate secrets exfiltration pipeline to any remote repository containing sensitive files outside .gitignore. The SKILL.md explicitly prohibits the agent from using native git tooling in favor of this script, removing agent-level safety controls and staged-file review. No active exfiltration was detected during the install audit and canary integrity was maintained, but the design pattern is inherently hazardous in real user environments.
Category Scores
Findings (6)
HIGH Unconditional 'git add .' followed by immediate 'git push' creates secrets exfiltration pipeline -45 ▶
smart_commit.sh stages every file in the working directory via 'git add .' (no filtering, no .gitignore verification beyond what git itself enforces) then immediately pushes to the remote origin. Any sensitive file present in the project tree that is not explicitly gitignored — .env files, private keys, cloud credentials, auth tokens — will be committed and pushed to the remote. This is a well-documented, high-impact secret exfiltration pattern whether intentional or accidental.
HIGH SKILL.md mandates shell script over native agent git tooling with explicit prohibition on alternatives -25 ▶
The skill instructs the agent 'ALWAYS use the script — do NOT use manual git commands'. This override directive replaces the agent's built-in, auditable git tool calls with a single monolithic shell script invocation. It removes the agent's ability to stage selectively, display diffs for review, or apply any platform-level tool-use controls. The prohibition ('do NOT') is unusually forceful for a legitimate skill.
MEDIUM Overly broad automatic activation triggers risk unintended git operations -15 ▶
The skill's frontmatter description and 'When to Use' section enumerate numerous short, ambiguous phrases that will auto-activate this skill. Phrases like 'push this', 'save to github', 'let's push this up', and 'commit these changes' are common in coding conversations and may trigger a full git add . + push cycle on repositories the user did not intend to operate on.
MEDIUM Shell script mandated as sole workflow with no sensitive file filtering or staging review -35 ▶
The packaged shell script is the only permitted execution path per SKILL.md. It provides no pre-commit review step, no warning when staged file count is high, no detection of common sensitive file patterns (.env, *.pem, *_rsa, credentials), and no dry-run mode. Legitimate git automation scripts should include at minimum a pre-push sensitive file check.
LOW No .gitignore enforcement or sensitive file exclusion prior to staging -20 ▶
Beyond relying on whatever .gitignore the target repository happens to have, smart_commit.sh performs no additional safety checks before staging all files. A project that accidentally lacks a .gitignore entry for .env or has a partial .gitignore would have secrets staged and pushed without any warning.
INFO Canary files read-accessed at pre-install and post-install timestamps — consistent with monitoring framework -10 ▶
Honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, GCP credentials) were opened and read at audit timestamps 1787404161 (5 seconds before git clone) and 1787404173 (6 seconds after install completed). The Canary Integrity check confirms all files remain unmodified and no content left the system externally. Both read clusters align with the audit framework's own baseline sampling and final integrity verification routines.