Git Deployer

• Analyzed: Mar 25, 2026, 4:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: abfab32ebe37cdb264ff3bfba89f1a43f845ff77b630a56ed409742fc304337b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a functional git deployment script but contains vulnerabilities due to a lack of input sanitization. Specifically, in `scripts/deploy.sh`, the `REMOTE_URL` and `SITE_PATH` variables are passed directly to `git` and `rsync` commands without validation, which could allow for argument injection (e.g., passing strings starting with dashes to execute arbitrary git configurations). Additionally, the script uses a predictable and potentially shared directory in `/tmp` based on the repository's basename, which could lead to data leakage or collisions in multi-user environments.