Is git-workflow-and-versioning/SKILL.md safe?
https://github.com/addyosmani/agent-skills/tree/main/skills/git-workflow-and-versioning/SKILL.md
The skill audit failed critically due to installation errors that prevented retrieval and analysis of any skill content. While no active malicious behavior was detected, the complete inability to examine the skill creates unacceptable security risks since potential threats cannot be identified or assessed.
Category Scores
Findings (6)
CRITICAL Installation Failure Prevents Security Analysis -70 ▶
The skill failed to install due to a pre-existing directory conflict, preventing any analysis of the actual skill content. This creates a blind spot where malicious content could be present but undetectable.
MEDIUM Suspicious Canary File Access Pattern -15 ▶
Multiple sensitive credential files were accessed during the audit process, including .env, SSH keys, AWS credentials, npm config, Docker config, and GCloud credentials. While no modifications or exfiltration occurred, the access pattern is concerning.
HIGH Unable to Analyze Prompt Content -50 ▶
Due to installation failure, the skill's SKILL.md content could not be retrieved and analyzed for prompt injection attacks, creating a significant security gap.
HIGH Unable to Analyze Executable Content -50 ▶
Installation failure prevented analysis of any executable code, scripts, or package.json install hooks that could pose code execution risks.
HIGH Complete Analysis Failure -60 ▶
Without access to the skill content, it's impossible to assess potential behavioral risks, privilege escalation, or interaction with other system components.
LOW Canary File Access Without Modification -10 ▶
Sensitive files were accessed but not modified or exfiltrated, suggesting read-only reconnaissance rather than active attack.