Security audit
Security checks for vulnerabilities and agentic risk
This Gitea helper is coherent, but it documents high-impact repository actions without enough safety guardrails for deletion, secrets, and webhooks.
Install only if you want an agent to help administer Gitea through your tea login. Review destructive or persistent commands before use, especially repository deletion, CI/CD secrets, PR merges, and webhooks, and require explicit confirmation for any action that changes server state.
The skill explicitly documents a forceful repository deletion command without any cautionary language, confirmation guidance, or recommendation to verify the target repository first. In an agent-skill context, this increases the chance that a user or automation invokes an irreversible destructive action against the wrong repository, causing data loss or service disruption.
The skill describes creating action secrets but does not warn that the values are sensitive credentials that must not be logged, echoed, hardcoded, or exposed in shell history. In an agent-driven workflow, this omission can lead to accidental secret disclosure through prompts, transcripts, command history, or CI configuration misuse.
The webhook example creates an outbound integration to an arbitrary external URL without warning that repository event payloads may contain sensitive metadata or trigger untrusted systems. In this context, users may unknowingly exfiltrate repository activity data or create a persistence/integration point to an attacker-controlled endpoint.
No suspicious patterns detected.
