lf-git-sync
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard git operations such as
git fetch,git pull, andgit submodule update. These operations are performed to synchronize the local repository state with remotes, which is the primary purpose of the skill. - [DATA_EXFILTRATION]: Network activity is restricted to standard git protocols for fetching and pulling from established remote repositories. No unauthorized external connections or exfiltration patterns (such as
curlto unknown domains) were identified. - [PROMPT_INJECTION]: The skill instructions do not contain attempts to override system safety guidelines or bypass agent constraints. Role-play instructions are limited to establishing a professional context for repository management.
- [INDIRECT_PROMPT_INJECTION]: The skill processes output from git commands, such as branch names and commit messages. While these could theoretically contain malicious strings in an untrusted repository, they are used solely as arguments for further git commands or displayed in a summary, posing minimal risk in standard development environments.
Audit Metadata