github-sensitive-data-cleanup — agentic threat model

Not certain from the listing — the specific foundation models used for PII/secret detection are not disclosed. If LLMs are used for classification, they are vulnerable to prompt injection that could trick the agent into ignoring actual secrets or falsely flagging and deleting benign code.

The agent processes highly sensitive data, specifically git history containing leaked secrets, API keys, and PII. There is a severe risk of data exfiltration if the agent's memory or output channels are compromised, potentially exposing the very secrets it is tasked with cleaning.

The agent framework orchestrates destructive git commands (history rewriting, force-pushing). Vulnerabilities in the orchestration code or tool-calling mechanism could allow an attacker to inject arbitrary git commands, leading to unauthorized repository modification or deletion.

Not certain from the listing — the execution environment (sandbox, local runner, or cloud container) is not specified. Because the agent executes mutating shell/git commands, a lack of strict containerization could allow container escape or host compromise.

The agent features built-in safety checks, including pre-push visibility and backup verification. However, if the logging or observability stack is compromised, an attacker could bypass these checks or hide malicious history-rewriting activities.

This agent requires high-privilege write and force-push permissions to target repositories. Compromise of the agent's identity or credentials represents a critical risk, as it holds the keys to modify or destroy repository history.

As a 'Community Agent Skill', this tool may be integrated into larger multi-agent workflows or developer environments. Malicious updates to this community skill could introduce supply-chain vulnerabilities, compromising any repository it is granted access to.