Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent fork-management skill, but it grants high-impact automation over Git branches and permits configurable post-sync commands that users should review carefully.
Install only for repositories where you are comfortable giving an agent authority to fetch, rebase, merge, push, rewrite branches with --force-with-lease, and use your GitHub CLI credentials. Review each repo config before use, avoid enabling persistent autoResolveConflicts unless you accept automatic branch rewrites, and do not use postSyncHooks from untrusted configs.
SKILL.md:747Unrestricted Execution of Repository-Defined Post-Sync Hooks
SKILL.md:533Semantic AI Conflict Resolutions Are Force-Pushed Before Human Review
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
git fetch git checkout git merge / git push
### `rebase <branch>` - Rebase de uma branch específica
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
done
# Push
git push <originRemote> <productionBranch> --force-with-lease
# Restaurar arquivos não-commitados
if [ "$STASHED" = "1" ]; then
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- **Git operations**: fetch, checkout, merge, rebase, push across multiple remotes and branches
- **GitHub CLI**: reads PR status, creates PRs, queries repo metadata
**Before using this skill on a repository:**
- All git push operations use `--force-with-lease` (not `--force`) to prevent data loss
- The skill always stashes uncommitted files before destructive branch operations
These capabilities are inherent to fork management and cannot be removed without breaking core functionality.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 1. Clone the repository
git clone https://github.com/Glucksberg/fork-manager-skill.git /path/to/fork-manager
# 2. Create local configs from examples
cd /path/to/fork-manager
cp repos/<project>/config.example.json repos/<project>/config.json
The README advertises broad natural-language triggers like "Use fork-manager to do a full-sync of my-project" and "Check the status of my fork," which are likely to overlap with ordinary user requests in agent environments that auto-dispatch skills. Because this skill performs high-impact git and GitHub operations, accidental invocation could cause unintended syncs, rebases, branch changes, or downstream automation, especially given the documented conflict-resolution subagent behavior in the skill metadata.
The file switches into imperative policy text in Portuguese at L029 ('A skill NUNCA deve ser executada inline...') and continues with substantial user-facing operational guidance in Portuguese across multiple sections. There is no opt-in, language choice, or stated regional justification, so this creates a language/locale policy issue for users who do not read Portuguese.
The skill explicitly allows repo-specific post-sync hooks defined in config as shell commands, which expands behavior from fork management into arbitrary command execution. Because the commands are sourced from per-repo configuration and run after sync, a malicious or compromised config can execute attacker-controlled code with the agent's filesystem and network privileges.
The manifest metadata at L004 declares required binaries git and gh, but the skill documentation repeatedly instructs use of node for scripts/update-config.mjs and jq for PR-audit processing. That creates a description/behavior mismatch because the declared runtime requirements understate what the skill actually needs to execute as written.
Detected: suspicious.dangerous_exec