lf-git-sync

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard git operations such as git fetch, git pull, and git submodule update. These operations are performed to synchronize the local repository state with remotes, which is the primary purpose of the skill.
  • [DATA_EXFILTRATION]: Network activity is restricted to standard git protocols for fetching and pulling from established remote repositories. No unauthorized external connections or exfiltration patterns (such as curl to unknown domains) were identified.
  • [PROMPT_INJECTION]: The skill instructions do not contain attempts to override system safety guidelines or bypass agent constraints. Role-play instructions are limited to establishing a professional context for repository management.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from git commands, such as branch names and commit messages. While these could theoretically contain malicious strings in an untrusted repository, they are used solely as arguments for further git commands or displayed in a summary, posing minimal risk in standard development environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 12:15 AM
Security Audit — agent-trust-hub — lf-git-sync