Security audit
Security checks for vulnerabilities and agentic risk
This Git helper is not clearly malicious, but it needs review because it grants command/write access for mutating Git actions while its trigger scope is broad and loosely defined.
Review this skill before installing. It appears to be a low-quality or generic Git helper rather than malware, but it can guide an agent toward command execution and repository changes, including push/pull behavior. Use it only in repositories where you are comfortable with agent-assisted Git mutations, and require confirmation before any command that changes files, branches, remotes, or history.
The activation text is overly broad and unrelated to Git, including system monitoring, log analysis, alerting, and deployment management. In an agent environment, this can cause the skill to be selected in contexts far outside its intended scope, exposing exec/write capabilities during unrelated tasks and increasing the chance of unintended repository or shell actions.
The skill advertises pull/push plus command execution while lacking a clear warning that these actions can modify local repositories and remote state. In this context, the danger is elevated because the skill declares exec and write tool access, so an agent could perform destructive or irreversible Git operations without sufficiently explicit user consent or safety boundaries.
