Security audit

Git Pro

Security checks across malware telemetry and agentic risk

Overview

This is a small Git command guidance skill with disclosed history-rewriting workflows, and no hidden code, persistence, or data exfiltration behavior was found.

Install only if you want concise advanced Git workflow guidance. Treat rebase, amend, and force-with-lease as high-impact commands: use them on personal branches, confirm the target branch before pushing, and avoid rewriting shared history without team agreement.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill gives concise guidance on interactive rebase and pull --rebase, which are history-rewriting operations, but does not warn about backup, conflict handling, or the risk of rewriting shared/public branch history. In a user-invocable skill, this omission can lead users to lose commits or disrupt collaborators, especially if they apply the commands outside personal feature branches.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The PR workflow recommends --force-with-lease, which is safer than --force but still rewrites remote history and can overwrite teammates' expectations if used after rebasing or amending published commits. The skill mentions a positive safety marker, but it does not clearly explain the coordination risks, branch-scope limitations, or need for team agreement before force-pushing.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.