speckit-git-remote — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited speckit-git-remote (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect the Git remote URL for integration with GitHub services (e.g., issue creation).
git rev-parse --is-inside-work-tree 2>/dev/null [specify] Warning: Git repository not detected; cannot determine remote URLRun the following command to get the remote URL:
git config --get remote.origin.urlParse the remote URL and determine:
github from https://github.com/github/spec-kit.git)spec-kit from https://github.com/github/spec-kit.git)Supported URL formats:
https://github.com/<owner>/<repo>.git[email protected]:<owner>/<repo>.git[!CAUTION] ONLY report a GitHub repository if the remote URL actually points to github.com. Do NOT assume the remote is GitHub if the URL format doesn't match.
If Git is not installed, the directory is not a Git repository, or no remote is configured:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.