Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/shared.ts:13
- Evidence
execFile("git", args, { cwd, timeout: timeoutMs }, (err, stdout, stderr) => {
Security audit
Git Tools
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible Git helper, but its sync command can clone into paths outside the intended workspace and silently changes a global Git setting.
Review the `/git_sync` behavior before installing. It is reasonable for Git management, but it should be fixed to keep clone targets under the workspace and avoid global Git config changes. Use it with limited Git credentials and run sync only when you intend to update repositories.
Static analysis
Detected: suspicious.dangerous_exec