gitcode-cli

SUSPICIOUS: The skill’s capabilities broadly fit GitCode repo management, but its trust chain is weak. It installs a broad, unofficial-seeming CLI from npm and then has the user provide a GitCode PAT to it, creating meaningful credential-forwarding and supply-chain risk despite otherwise coherent purpose and no confirmed exfiltration behavior.

该代码片段是用于 GitCode 提交和 PR 自动化的操作文档，未发现明确恶意载荷、数据窃取、持久化或破坏系统行为。存在中等安全风险：令牌明文嵌入 Git remote 并写入配置文件、未固定版本安装第三方 npm CLI、全量提交改动以及使用 --no-verify。应改用 Git 凭据管理器或临时认证方式，限制配置文件权限，固定并校验 CLI 版本，审查 git status 后再选择性暂存，并避免跳过安全钩子。