title: Silent git-remote + mirror-push Exfiltration from Skill Instructions
id: ATR-2026-00527
rule_version: 1
status: stable
description: |
  Detects the Mitiga Labs (2026-05-05) silent-codebase-exfiltration pattern where a Claude Code or generic agent skill instructs the agent to add a new git remote pointing at an attacker-controlled host and then push the full repository contents — typically with `--mirror`, `--all`, or `--force` to grab branches the user did not stage. The Mitiga write-up showed the full exfiltration completing in four user interactions while the Claude Code skill-audit.log stayed empty. The detection target is the combination of git remote modification AND a wide-scope push within the same skill block. Legitimate developer skills almost never need both within a single set of instructions.
author: ATR Community (vendor-corpus-import)
date: 2026/05/23
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM06:2025
  owasp_agentic:
    - ASI04:2026
    - ASI02:2026
  mitre_atlas:
    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
    - AML.T0048 - External Harms
compliance:
  owasp_agentic:
    - id: ASI04:2026
      context: |
        Silent git mirror-push is a textbook ASI04:2026 Data Exfiltration vector executed through the agent's shell tool. The skill weaponizes the agent's existing repository access.
      strength: primary
  owasp_llm:
    - id: LLM06:2025
      context: |
        LLM06:2025 Excessive Agency: the skill expands the agent's behavior beyond user intent by performing repository push under skill control.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: |
        Article 15 robustness — defending against skill-borne exfiltration is required for high-risk AI systems with code-repository access.
      strength: primary
    - article: '10'
      context: |
        Article 10 data governance — repository content includes source code which may be IP or contain secrets; this rule guards that exposure.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions).
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.4.3
      context: |
        Supply-chain monitoring under MG.4.3 must include the skill instruction layer; this rule is the runtime detection signature.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions).
      strength: secondary
  iso_42001:
    - clause: '8.3'
      context: |
        AIMS information security under 8.3 requires controls against unauthorized data egress; detection events feed the incident path.
      strength: primary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Silent git-remote + mirror-push Exfiltration from Skill Instructions).
      strength: primary
tags:
  category: skill-compromise
  subcategory: silent-exfiltration
  scan_target: skill
  confidence: high
  source: vendor-test-suite
  vendor_sources: mitiga-labs
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: git\s+remote\s+(?:add|set-url)\s+\S+\s+(?:https?://|git@|ssh://)(?!(?:[\w-]+\.)?(?:github\.com|gitlab\.com|bitbucket\.org|codeberg\.org|gitea\.io|git\.sr\.ht|sourcehut\.org|dev\.azure\.com|visualstudio\.com)[/:])[^\s'"]{3,}[\s\S]{1,800}git\s+push(?:\s+\S+)?\s+(?:--mirror|--all|--force|--force-with-lease|--prune)
      description: |
        Cross-line match for the silent-exfiltration shape: a git remote modification pointing at a NON-allowlisted host followed within ≤800 chars by a `git push` flagged with --mirror (full repo + refs), --all (all branches), --force, or --prune. Allowlist covers github / gitlab / bitbucket / codeberg / sourcehut / gitea.io / Azure DevOps. Internal corporate VCS hosted outside these public services should add a per-org suppression annotation rather than suppress this rule globally — the wide-scope push is the IOC.
    - field: user_input
      operator: regex
      value: git\s+(?:push|remote\s+add)\s+\S+\s+(?:https?://|git@|ssh://)(?:[a-z0-9-]+\.)*(?:tk|ml|ga|cf|gq|xyz|top|click|live|host|space|fun|monster|cyou|sbs|ws)\b
      description: |
        Direct match on git remote/push targeting a host whose TLD is in the common DGA/parked-domain set (.tk, .ml, .ga, .cf, .gq, .xyz, .top, .click, .live, .host, .space, .fun, .monster, .cyou, .sbs, .ws). Standalone IOC even without a paired wide-scope push flag.
  condition: any
  false_positives:
    - Tutorial skills explaining git remote/push commands as documentation — the regex requires both remote modification AND push --mirror/--all/--force/--prune within 800 chars OR a suspicious TLD.
    - Internal corporate Gitea/GitLab self-hosted on a .cloud or .host TLD that is allowlisted by the org. The TLD list is a heuristic; orgs should suppress the second condition via local allowlist.
    - Migration runbooks that show `git push --mirror` from one trusted host to another. Recommend a per-skill allowlist annotation rather than removing the rule.
response:
  actions:
    - block_input
    - alert
    - snapshot
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-00527] Skill instructs git remote modification + wide-scope push, OR targets a non-standard hosting TLD. This matches the Mitiga Labs silent-codebase-exfiltration shape (2026-05-05). Skill blocked pending review.
confidence: 85