git-ci

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script downloads an installer from the author's official GitHub repository (https://raw.githubusercontent.com/Sanix-Darker/git-ci.releases/main/install.sh). This download is documented and only occurs when the user explicitly provides the --apply flag after reviewing a planned change.
  • [COMMAND_EXECUTION]: The skill uses ssh to execute commands on remote VPS hosts. These commands are scoped to GCI operations and the scripts/setup.sh script includes input validation to prevent command injection via the host or ssh_target arguments.
  • [REMOTE_CODE_EXECUTION]: When --apply is used, the skill downloads and executes an installer script on the remote host. The skill follows safe practices by downloading to a temporary file first rather than piping directly from the network into a shell, and it directs users to review the installer source code before execution.
  • [CREDENTIALS_SAFE]: The skill explicitly instructs the agent never to ask for or reveal sensitive values such as private keys, passphrases, or service tokens. It relies on standard OpenSSH authentication mechanisms (e.g., ssh-add).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 09:43 PM
Security Audit — agent-trust-hub — git-ci