Git Deployer

• Analyzed: Mar 25, 2026, 3:21 PM
• Findings: 1
• Version: 1.0.0
• Hash: adf739f6c06f4222daa70613d22805b81bfcbda5e993612905890abab2ef7c0c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The git-deployer skill provides a bash script (scripts/deploy.sh) that performs destructive operations, specifically 'rsync --delete' and 'git push --force', to sync local content to a remote repository. While these actions are aligned with the stated purpose in SKILL.md and include warnings about overwriting remote state, the script lacks input validation for the 'site_path' and 'remote_url' arguments. The combination of broad shell, network, and file system access with destructive capabilities qualifies it as suspicious under the provided criteria, despite the lack of clear malicious intent.