setup-git
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local command execution using the
gitCLI for repository initialization and commit management. It also invokes a vendor-specific Python moduleskore_skillsviapython -m skore_skillsto analyze project structure, manage ignore policies, and review untracked files. These operations are restricted to the local workspace and follow established version control workflows.\n- [DATA_EXPOSURE]: The skill implements proactive data protection by explicitly blacklisting sensitive files and directories. Instructions specifically forbid staging or tracking.env,.skore,.venv, and.pixifiles, significantly reducing the risk of accidental credential or environment configuration exposure during the git setup process.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes file paths and metadata returned by local analysis tools to prompt users for tracking decisions. While this represents an ingestion surface for potentially untrusted file names, the risk is mitigated by explicit instructions to avoid reclassifying paths from the tool's JSON output and the strict enforcement of the sensitive file blacklist.
Audit Metadata