gitload

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7827797a09e870ad7d361bbd5984db41c1274e94f1d1d6dd9b37d68c5cd6a015
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill `gitload` is designed to download files, folders, or entire repositories from GitHub. The `SKILL.md` provides instructions for using the `gitload-cli` tool, including examples for downloading content, specifying output paths, and handling authentication with GitHub tokens. All described actions, such as file system writes, network access to GitHub, and the use of `npx` or `npm install`, are directly aligned with the stated purpose of fetching GitHub content. There is no evidence of intentional harmful behavior, data exfiltration, persistence mechanisms, or prompt injection attempts designed to subvert the agent's purpose or compromise the system. The risks associated with executing remote code via `npx` or `npm install` are inherent to these tools and not introduced by malicious intent within the skill's instructions.