Security audit

Git工作流助手免费版

Security checks across malware telemetry and agentic risk

Overview

This is a visible Markdown Git workflow guide whose risky commands are Git-related and expected, but users should be careful with cleanup and force-delete examples.

Installers should understand that this skill may suggest Git commands that modify repositories, push to remotes, change global Git configuration, or delete local untracked work, branches, and stashes. Review generated commands before execution, prefer preview or safer variants first, and keep backups for important work.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill presents destructive cleanup commands such as git clean -f and git clean -fd without an adjacent warning that they permanently delete untracked files and directories. In an agent context with exec capability, users may follow or automate these commands and irreversibly lose local work, especially because the skill is designed to provide directly usable output.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Commands for force-deleting branches and clearing all stashes are shown without immediate warnings about permanent data loss. In this skill's context, which supports executable guidance and targets routine developer workflows, omissions like this increase the chance that a user or agent executes destructive actions casually and loses recoverability.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.