sync-repos
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute a local shell script (
scripts/sync-public.sh) to perform file synchronization and parity checks between two directories. - [DYNAMIC_EXECUTION]: In its setup mode, the skill generates a Bash script (
sync-public.sh) and a configuration file (sync-public.conf) based on templates provided in the reference documentation. These generated files are intended to be executed locally by the agent to perform the synchronization tasks. - [INDIRECT_PROMPT_INJECTION]: The skill performs file comparisons and scans on local git repositories, which represents an ingestion point for external data.
- Ingestion points: Local file systems and directory structures of the development and public repository paths provided by the user.
- Boundary markers: The comparison logic uses SHA-256 hashing and file manifests to detect drift rather than interpreting file content as instructions.
- Capability inventory: The skill utilizes
bash,rsync,git, andgrepfor its operations. - Sanitization: The skill summarizes differences and scans for PII/secrets using regex patterns before suggesting a sync, providing a layer of safety review.
Audit Metadata