git-ci
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript downloads an installer from the author's official GitHub repository (https://raw.githubusercontent.com/Sanix-Darker/git-ci.releases/main/install.sh). This download is documented and only occurs when the user explicitly provides the--applyflag after reviewing a planned change. - [COMMAND_EXECUTION]: The skill uses
sshto execute commands on remote VPS hosts. These commands are scoped to GCI operations and thescripts/setup.shscript includes input validation to prevent command injection via thehostorssh_targetarguments. - [REMOTE_CODE_EXECUTION]: When
--applyis used, the skill downloads and executes an installer script on the remote host. The skill follows safe practices by downloading to a temporary file first rather than piping directly from the network into a shell, and it directs users to review the installer source code before execution. - [CREDENTIALS_SAFE]: The skill explicitly instructs the agent never to ask for or reveal sensitive values such as private keys, passphrases, or service tokens. It relies on standard OpenSSH authentication mechanisms (e.g.,
ssh-add).
Audit Metadata