Silent git-remote + mirror-push Exfiltration from Skill Instructions
A malicious or compromised 'skill' (instructions given to an AI coding agent like Claude Code) tells the agent to add a new git remote pointing at a server the attacker controls, then push the whole repository there using flags like --mirror or --all. This can copy the entire codebase, including branches the developer never intended to share, in just a few agent interactions and without showing up in normal audit logs.
How the attack works
An attacker plants instructions inside an agent skill that looks like a normal developer helper. The skill directs the agent to run a git command that adds a new remote pointing to an external host. In the same set of instructions, it also directs a wide-scope push (--mirror, --all, --force, or --prune) to that remote. Because both steps happen inside routine-looking agent activity, the exfiltration can complete in a handful of interactions with no obvious trace in the skill's own logging.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 86fd726b-5aae-4476-9ec7-39f0d04821e4
- Severity
- Critical
Why it matters
An organization can lose its full source code, including private branches and history, to an outside party without any alert firing through normal audit trails.
What you can do
- →Review any AI agent skill or instruction set before use for git remote-add and push commands, especially combined with --mirror, --all, --force, or --prune.
- →Restrict which git remotes an agent is allowed to add or push to, ideally via an allowlist of known internal hosts.
- →Require human approval for any agent action that adds a new remote or performs a wide-scope push.
- →If you self-host git on a less common TLD, add it to a local allowlist rather than disabling this check entirely, and flag migration runbooks that legitimately use git push --mirror.
Known benign look-alikes
- Tutorial skills explaining git remote/push commands as documentation — the regex requires both remote modification AND push --mirror/--all/--force/--prune within 800 chars OR a suspicious TLD.
- Internal corporate Gitea/GitLab self-hosted on a .cloud or .host TLD that is allowlisted by the org. The TLD list is a heuristic; orgs should suppress the second condition via local allowlist.
- Migration runbooks that show `git push --mirror` from one trusted host to another. Recommend a per-skill allowlist annotation rather than removing the rule.