githits-onboarding

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx -y githits@latest to download and execute the latest version of the GitHits CLI from the npm registry. This is a standard procedure for maintaining up-to-date tooling and is directed at the vendor's own published package.
  • [COMMAND_EXECUTION]: Shell commands are executed to probe the local environment for supported coding tools and to write MCP (Model Context Protocol) configuration files. The execution is localized to environment detection and setup tasks.
  • [DATA_EXFILTRATION]: No unauthorized data access or transfer patterns were detected. The instructions include strong safety guardrails that prohibit the agent from asking for, displaying, or storing sensitive secrets like API tokens, OAuth codes, or passwords within the chat session.
  • [PROMPT_INJECTION]: The skill contains no instructions designed to bypass agent safety filters or override system behavior. It uses structured logic to guide the onboarding flow through explicit user choices.
  • [COMMAND_EXECUTION]: The skill uses structured JSON output from its own CLI to drive decision-making. This reduces the risk of misinterpreting command results while maintaining a visible and sequential execution path for the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 05:01 AM
Security Audit — agent-trust-hub — githits-onboarding