sync-public-skills
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages repository state by executing local PowerShell scripts (
Sync-AndPush.ps1,Commit-DirtySkills.ps1,Sync-InternalSkills.ps1) and command-line interfaces includinggitandgh. - [DATA_EXFILTRATION]: Performs synchronization of local repository content to public and internal GitHub repositories via
git push. This core functionality involves reading local directory structures and transmitting data to remote servers. - [PROMPT_INJECTION]: The skill's workflow involves auditing and classifying 'dirty' or uncommitted skill files from the local filesystem. This process creates an indirect prompt injection surface where malicious instructions within a processed file could attempt to influence the agent's classification logic or sync operations.
Audit Metadata