ljg-push
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
Tools/Push.sh) to manage the synchronization workflow. This script utilizes system commands includinggit,rsync,sed, andfindto update files and manage repository state. - [COMMAND_EXECUTION]: The skill uses
curlto send status notifications to a local endpoint (http://localhost:31337/notify) during execution. - [EXTERNAL_DOWNLOADS]: The shell script automatically clones the target repository from GitHub (
github.com/lijigang/ljg-skills.git) if the local path is missing. - [DATA_EXFILTRATION]: The core functionality involves uploading local skill configuration files from
~/.claude/skills/to a remote repository on GitHub, which is the intended purpose of the skill.
Audit Metadata