soemoescode

Guardskill — Security skill for Claude Code

Security community

Read-only scanner for git settings that let a repository run code in coding agents (Claude Code, Codex, Cursor, Copilot).

How to install Guardskill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open soemoescode/guardskill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Guardskill does

Read-only scanner for git settings that let a repository run code in coding agents (Claude Code, Codex, Cursor, Copilot). Covers the GitSpawn class and CVE-2026-45033. No dependencies, no network, no telemetry.

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
/web3 Audit — Smart contract security audit using the 10-bug-class methodology 927 ★
Reflexion — Audit and optimize the .claude/ ecosystem — skills, hooks, guides, patterns, agents, and settings — for qualit 224 ★

README

GuardSkill

**A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do.**

npx guardskill .

Read-only. No network calls, no telemetry, no config, no account. It reads git configuration and hook scripts, prints what it found, and exits.

The problem

Coding agents gather context by running ordinary git commands — `git status`, `git diff` — as soon as they open a project. Git reads its settings from the repository's own `.git/config`, and several of those settings name a program for git to execute. Put a command in `core.fsmonitor` and it runs, with your privileges, outside any sandbox, before you have typed anything.

Two pieces of public research make this concrete:

GitSpawn — Manifold Security reported eight findings across seven coding agents (Claude Code, OpenAI Codex, Cursor, Goose, Grok Build, Qwen Code, Hermes Agent), several still unpatched at the time of publication. Their note on delivery matters: cloning a hostile URL does not trigger it, because .git/config is not transferred by a clone. The repository has to arrive as files with its .git directory already inside — a zip, a shared drive, a sync folder, a USB stick, an agent that unpacks an archive. (Manifold Security, The Hacker News)
CVE-2026-45033 — GitHub Copilot CLI, CVSS 8.5. A bare repository hidden anywhere in the project tree is enough: git discovers it while walking directories and applies its configuration, including keys that execute commands. Fixed in @github/copilot 1.0.43 by forcing safe.bareRepository=explicit. (GitHub Advisory)

The recommended user-side mitigation in both write-ups is the same: **inspect the git configuration before you open the directory with an agent.** That is a