# Silent git-remote + mirror-push Exfiltration from Skill Instructions

- **Severity:** Critical
- **Signature ID:** `86fd726b-5aae-4476-9ec7-39f0d04821e4`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API), AML.T0048 (External Harms)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM06 (Excessive Agency), LLM10 (Unbounded Consumption)

## Summary

A malicious or compromised 'skill' (instructions given to an AI coding agent like Claude Code) tells the agent to add a new git remote pointing at a server the attacker controls, then push the whole repository there using flags like --mirror or --all. This can copy the entire codebase, including branches the developer never intended to share, in just a few agent interactions and without showing up in normal audit logs.

## How the attack works

An attacker plants instructions inside an agent skill that looks like a normal developer helper. The skill directs the agent to run a git command that adds a new remote pointing to an external host. In the same set of instructions, it also directs a wide-scope push (--mirror, --all, --force, or --prune) to that remote. Because both steps happen inside routine-looking agent activity, the exfiltration can complete in a handful of interactions with no obvious trace in the skill's own logging.

## Why it matters

An organization can lose its full source code, including private branches and history, to an outside party without any alert firing through normal audit trails.

## What you can do

- Review any AI agent skill or instruction set before use for git remote-add and push commands, especially combined with --mirror, --all, --force, or --prune.
- Restrict which git remotes an agent is allowed to add or push to, ideally via an allowlist of known internal hosts.
- Require human approval for any agent action that adds a new remote or performs a wide-scope push.
- If you self-host git on a less common TLD, add it to a local allowlist rather than disabling this check entirely, and flag migration runbooks that legitimately use git push --mirror.

## Known benign look-alikes

- Tutorial skills explaining git remote/push commands as documentation — the regex requires both remote modification AND push --mirror/--all/--force/--prune within 800 chars OR a suspicious TLD.
- Internal corporate Gitea/GitLab self-hosted on a .cloud or .host TLD that is allowlisted by the org. The TLD list is a heuristic; orgs should suppress the second condition via local allowlist.
- Migration runbooks that show `git push --mirror` from one trusted host to another. Recommend a per-skill allowlist annotation rather than removing the rule.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00527

---
Source: https://www.netzilo.com/threats/atr-silent-git-remote-mirror-push-exfiltration-from-skill-instru