obsidian-git-repo-sync
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands, including
git init,git add, andgit push. Crucially, it interpolates user-provided input (<REMOTE_URL>) directly into the commandgit remote add origin <REMOTE_URL>. This presents a command injection risk if the user provides a malicious string containing shell metacharacters (e.g.,;,&, or backticks). - [DATA_EXFILTRATION]: The skill uses the command
git add -A, which stages all files and changes in the current directory for commit and subsequent upload to the remote repository. In an agentic environment where the workspace may contain sensitive files like.env,.sshkeys, or cloud credentials, this behavior can lead to the accidental exfiltration of private data to an external server.
Audit Metadata