Reddi Git Summary

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: reddi-git-summary Version: 1.0.2 The skill is a standard utility for summarizing Git repository status using common, non-destructive commands like 'git status', 'git log', and 'git remote'. It explicitly disables outbound network access in its metadata and includes a safety note to avoid exposing sensitive tokens found in remote URLs (SKILL.md).

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may read and display local repository metadata, including branch status, recent commits, and summaries of uncommitted changes.

Why it was flagged

The skill gives the agent terminal-based git commands to run. These commands are read-only and directly aligned with the stated repository-summary purpose, but they still access local repository state.

Skill content
use the terminal to run the following commands ... `git status --short --branch` ... `git log --oneline -10 --decorate` ... `git diff --stat`
Recommendation

Use it only in repositories whose metadata you are comfortable summarizing, and review the generated summary before sharing it externally.

What this means

A repository summary could accidentally reveal private remote URLs or embedded credentials if not redacted.

Why it was flagged

Configured Git remote URLs can reveal repository locations, account identifiers, or, in poor configurations, embedded access tokens. The artifact acknowledges this and instructs redaction.

Skill content
Run `git remote -v` to show configured remotes ... Always respect that some information may be sensitive - don't expose full URLs if they contain tokens.
Recommendation

Check remote URLs before including them in shared output, and remove any embedded tokens from Git remote configuration.