Security audit
Security checks for vulnerabilities and agentic risk
This Git helper is not overtly malicious, but it asks for command and write capability for repository-changing Git actions without clear user-confirmation boundaries.
Review this skill before installing. Use it only in repositories where you are comfortable with an agent running Git commands, and require confirmation for pull, push, branch changes, or any action that can alter local work or remotes.
The description uses broad, mismatched trigger language such as system monitoring, log analysis, alerting, and deployment management for a Git helper. In agent environments, overly broad activation criteria can cause the skill to be invoked in unintended contexts, increasing the chance it executes repository-affecting commands when the user did not intend Git actions.
The applicable-scope section is underspecified and broad enough that an agent may select this skill for generic ‘target data and configuration parameter’ tasks. Because the skill advertises exec capability and Git operations, ambiguous routing increases the risk of unintended command execution or repository modification in the wrong workflow.
The skill exposes the exec tool and describes Git pull/push/branch capabilities, but it does not prominently warn that it may execute shell commands and change repository state. In agent settings, missing consent and safety boundaries around state-changing actions can lead to unauthorized code changes, branch manipulation, pushes to remotes, or accidental disruption of working trees.
