sync-upstream
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard version control and text processing commands (
git status,git fetch,git merge,git diff,git grep,grep) to manage the merge process. These are appropriate for the skill's stated purpose of maintaining a git fork. - [EXTERNAL_DOWNLOADS]: The skill performs
git fetch upstream, which connects to a remote git repository. This is a standard operation in collaborative software development and is necessary for obtaining the changes to be merged. - [COMMAND_EXECUTION]: The skill checks for and executes a local repository script (
scripts/sync-upstream.sh) if present. While executing arbitrary scripts can be a risk, this is a common pattern for project-specific automation in development environments, and the skill explicitly includes a human-review step before completion. - [PROMPT_INJECTION]: The skill processes content from an external git branch (
upstream/main), which represents an indirect prompt injection surface. However, the instructions provide a clear framework for conflict resolution (a "ledger") and mandate that the agent must not commit the results, requiring final human verification of all changes. This significantly mitigates the risk of the agent obeying instructions embedded in the external codebase.
Audit Metadata