git-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous Git shell commands. These are legitimate tools for its stated purpose of repository management. It emphasizes safety by prioritizing
--force-with-leaseover--forceand requiring backups (git bundle) before destructive actions. - [EXTERNAL_DOWNLOADS]: Mentions several well-known and trusted developer tools (e.g., git-filter-repo, BFG Repo Cleaner, Husky, Lefthook). These are standard in the software development ecosystem and are sourced from their official repositories or package managers.
- [CREDENTIALS_UNSAFE]: The guides and examples contain string patterns resembling AWS keys and GitHub tokens (e.g., 'AKIAIOSFODNN7EXAMPLE'). These are clearly documented as placeholders and example data for the purpose of teaching users how to remove accidentally committed secrets from history.
- [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface as it processes repository data (commit messages and file contents) which could contain malicious instructions. However, the risk is inherent to the Git use case and the skill includes specific directives to confirm versions and follow strict playbooks, which acts as a procedural safeguard.
Audit Metadata