Git Sync

• Risk level: Low
• Analyzed: Apr 6, 2026, 7:34 AM
• Findings: 0
• Version: 1.3.0

Overview

The skill's code and instructions are consistent with its stated purpose (managing a small whitelist of local git repos); it requests no extra credentials and installs nothing, with only minor documentation/implementation mismatches to review before use.

This skill appears coherent and minimal, but review these before installing: - Confirm the whitelist (DEFAULT_REPOS and ~/.config/git-sync/repos.json) are correct; the script will operate on any path equal to or contained under a whitelisted repo path. - Be aware outputs include raw git stdout/stderr; avoid configuring remotes that embed tokens in URLs and don't assume error messages can't leak sensitive info. - Test locally from the command line first (the repository paths in the script are user-local and may not exist) and verify the --confirm behavior for pull/push works as you expect. - Note small doc/implementation mismatches (some advertised commands aren't implemented); if you rely on those, request clarification from the author. - If you need higher assurance, inspect the repo config file (~/.config/git-sync/repos.json) and the script in your environment to ensure paths and behavior match your security posture.