gitload
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use 'npx gitload-cli' or install the 'gitload-cli' package globally via npm. This involves downloading executable code from the public NPM registry, which is standard behavior for a tool-based skill.
- [COMMAND_EXECUTION]: The skill facilitates the execution of CLI commands to interact with the GitHub API. It provides structured examples for downloading content, creating ZIP archives, and managing output directories.
- [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill demonstrates the use of GitHub Personal Access Tokens (e.g., --token ghp_xxxx), these are clearly marked as placeholders. The instructions promote standard authentication practices (environment variables or CLI flags) for legitimate communication with GitHub's official API.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts GitHub URLs as input from users. This creates a surface for processing external data, but the skill is focused on file retrieval and does not involve automated execution of the downloaded content in a way that suggests a high-risk vulnerability.
Audit Metadata