push-skill-to-github
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to synchronize the local
~/.agentsdirectory with a remote Git repository usinggit push. The workflow employsgit add -A, which automatically stages every file within the directory. This creates a significant risk of inadvertently exfiltrating sensitive information, such as environment variables (.env), credentials, or private agent instructions that may reside in the workspace alongside the intended skills. - [COMMAND_EXECUTION]: The skill uses the
cmuxtool to spawn a terminal pane and execute a chain of shell commands:cd,git add,git commit, andgit push. Executing these commands in a secondary pane ('surface:NEW') may reduce the user's ability to monitor the exact files being staged and committed before the network operation (push) is completed.
Audit Metadata