gitignore
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches .gitignore templates from the official 'github/gitignore' repository on GitHub using curl. This is the intended behavior and targets a highly trusted source.
- [COMMAND_EXECUTION]: Executes a local bash script to retrieve templates and uses git commands (git status, git ls-files) to analyze the repository and verify that sensitive or generated files are correctly ignored. These operations are scoped to the project's root and serve the primary purpose of the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the GitHub templates repository which could theoretically contain malicious instructions if the source were compromised.
- Ingestion points: scripts/fetch-templates.sh downloads content from raw.githubusercontent.com/github/gitignore/main.
- Boundary markers: Absent; the skill does not explicitly warn the agent to ignore instructions embedded within the fetched templates.
- Capability inventory: Shell execution (bash), network access (curl), file system access (read/write), and git operations.
- Sanitization: No explicit sanitization of the fetched template text is performed before it is written to the .gitignore file.
Audit Metadata