NYC

git-multibranch

Fail

Audited by Snyk on Feb 15, 2026

Risk Level: HIGH
Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

  • Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows and recommends embedding SSH passwords on the command line (e.g., sshpass -p <password> and export GIT_SSH_COMMAND='sshpass -p password ...'), which would require the agent to place secret values verbatim into generated commands or scripts.

MEDIUM W013: Attempt to modify system services in skill instructions.

  • Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating system users, modifying /etc/ssh/sshd_config, restarting services, creating system-wide web directories, and enabling services (actions that require sudo/root and change the machine's security/state), so it pushes the agent to perform privileged and potentially unsafe system modifications.
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 15, 2026, 09:05 PM