CodeWhale git_show Argument Injection Leading to Arbitrary File Write

Technical Analysis

The entry point is a malicious or compromised git repository containing crafted content (e.g. commit messages, README, or file content) that prompt-injects the coding agent into invoking git_show with an attacker-chosen 'rev' value. Because CodeWhale does not insert a '--end-of-options' (--) sentinel before the argument, a rev string beginning with '--output=' is parsed by git as a flag rather than a literal revision, redirecting git's output stream to an arbitrary file path such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. The tool's auto-approved, read-only classification means the human-in-the-loop approval gate is bypassed entirely, so the agent executes the write without user review. This crosses the trust boundary between untrusted repository content (data) and the local shell/file system (execution), turning a passive 'view a git object' action into an unprompted arbitrary file write at the invoking user's OS privilege, enabling SSH key injection, shell RC file backdoors, or git config tampering for further supply-chain compromise.

Affected Systems

CodeWhale, codewhale-tui; protocols: MCP

Detection Signatures

• Tool invocation logs showing git_show or similar git subcommand calls with 'rev' parameter values starting with '--' (e.g., '--output=', '--upload-pack=', or other dash-prefixed strings)
• Repository content containing embedded instructions attempting to manipulate agent tool-call arguments (prompt injection patterns referencing file paths like ~/.ssh, ~/.bashrc, ~/.gitconfig)
• Unexpected modification timestamps on ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig correlated with coding-agent process activity
• Auto-approved tool definitions lacking argument sanitization or missing '--' end-of-options sentinel before user/model-supplied revision arguments
• CodeWhale versions >= 0.8.41 and < 0.8.64 in dependency manifests

Remediation Steps

1. 1

   Upgrade CodeWhale

   Update to codewhale/codewhale-tui version 0.8.64 or later, which adds proper validation of the 'rev' parameter.

2. 2

   Enforce argument sanitization for shell/git tool wrappers

   Audit any custom or third-party MCP tools that shell out to git or other CLIs; ensure all user- or model-supplied arguments are validated against an allowlist and that a '--' end-of-options sentinel is always inserted before variable arguments.

3. 3

   Remove blanket auto-approval for file-touching tools

   Reclassify tools that can influence file system state (even indirectly via redirection flags) as requiring human approval; do not trust a tool's self-declared 'read-only' label without independent verification.

4. 4

   Sandbox repository interactions

   Run git operations against untrusted/external repositories in an isolated, low-privilege container or VM with no access to sensitive user files like SSH keys or shell profiles.

5. 5

   Monitor sensitive file integrity

   Deploy file integrity monitoring on ~/.ssh/authorized_keys, shell rc files, and git config files to detect unauthorized modifications originating from agent tooling.