gitignore-gen

Warn

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the execution of npx ai-gitignore, a command that downloads and runs code from the NPM registry at runtime. The package is maintained by LXGIC Studios, which is not included in the trusted vendors list.- [COMMAND_EXECUTION]: The primary use case of the skill involves shell command execution to invoke the ai-gitignore tool.- [CREDENTIALS_UNSAFE]: The tool documented in the skill requires the OPENAI_API_KEY environment variable. While no specific keys are hardcoded, the use of external, unverified code to handle sensitive credentials is a security concern.- [DATA_EXPOSURE]: The utility scans the local directory for project configuration files like package.json, Cargo.toml, and go.mod to determine the project stack, representing a broad read access to project metadata.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 1, 2026, 05:14 AM