gitignore-gen
Warn
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the execution of
npx ai-gitignore, a command that downloads and runs code from the NPM registry at runtime. The package is maintained by LXGIC Studios, which is not included in the trusted vendors list.- [COMMAND_EXECUTION]: The primary use case of the skill involves shell command execution to invoke the ai-gitignore tool.- [CREDENTIALS_UNSAFE]: The tool documented in the skill requires theOPENAI_API_KEYenvironment variable. While no specific keys are hardcoded, the use of external, unverified code to handle sensitive credentials is a security concern.- [DATA_EXPOSURE]: The utility scans the local directory for project configuration files likepackage.json,Cargo.toml, andgo.modto determine the project stack, representing a broad read access to project metadata.
Audit Metadata