{"data":{"skill":{"slug":"sickn33-git-pushing","name":"git-pushing","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/git-pushing","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"fe8f73f1-07ca-44e1-922d-cb8701ec8841","skill_id":"e4d40ea4-ca41-475d-b26b-3f694d099d3b","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:32a3795818eaa3bf4e46f30fc296fe1568a9ae4b9ca01f478bac150e7eb4bec6:9e6e0206a086ad95fc834a3812020cc764ab896beec333d553663a8a48470cf6:736b696c6c732f7369636b6e33332f6769742d70757368696e67:10a63bdd8936e886c64987f0f31bef73","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The five static alerts are false positives because they identify code fences, an interpreter declaration, and a hardcoded Git branch lookup. The workflow still has medium operational risk because it stages every unignored change and pushes to origin without review or confirmation.","remediation":[{"issue":"Bulk staging can include sensitive or unrelated files.","severity":"medium","suggestion":"Show Git status and diff, stage selected paths, and require confirmation before committing and pushing."},{"issue":"The script pushes the current branch to origin automatically.","severity":"medium","suggestion":"Display the resolved remote and branch, then require explicit confirmation before Git push."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/smart_commit.sh","line_end":14,"line_start":14},{"file":"scripts/smart_commit.sh","line_end":1,"line_start":1},{"file":"SKILL.md","line_end":27,"line_start":25},{"file":"SKILL.md","line_end":31,"line_start":27},{"file":"SKILL.md","line_end":33,"line_start":31}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unreviewed Bulk Commit and Remote Push","locations":[{"file":"scripts/smart_commit.sh","line_end":17,"line_start":8}],"confidence":0.98,"description":"The script stages every unignored change, commits it, and pushes the current branch to origin without a diff review or confirmation. This can publish secrets, unrelated files, or unintended code.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The code directly runs git add, git commit, and git push in sequence. No review or confirmation step appears between these operations."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":61,"audit_model":"codex","audited_at":"2026-07-23T23:45:19.318+00:00","created_at":"2026-07-26T13:23:23.29007+00:00","static_findings":[{"id":"external_commands:scripts/smart_commit.sh:14:shell-command-substitution","file":"scripts/smart_commit.sh","pattern":"Shell command substitution","snippet":"BRANCH=$(git rev-parse --abbrev-ref HEAD)","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:scripts/smart_commit.sh:1:unix-shell-invocation","file":"scripts/smart_commit.sh","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":1,"severity":"medium","line_start":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":27,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":31}],"finding_verdicts":[{"id":"external_commands:scripts/smart_commit.sh:14:shell-command-substitution","reason":"The substitution runs a fixed Git command and captures the current branch. No user-controlled text enters the command, and the result is quoted when used.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/smart_commit.sh:1:unix-shell-invocation","reason":"This line is only the Bash interpreter declaration. It does not construct a command from untrusted input or create an independent execution risk.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The snippet is a Markdown code-fence marker, not Ruby backtick execution. It only introduces a documented Bash command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The snippet is a closing Markdown code fence. It is documentation syntax and cannot execute a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The snippet is a Markdown code-fence marker for the custom-message example. It is not executable Ruby or shell backtick syntax.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Unreviewed Bulk Commit and Remote Push","severity":"medium","locations":[{"file":"scripts/smart_commit.sh","line_end":17,"line_start":8}],"confidence":0.98,"description":"The script stages every unignored change, commits it, and pushes the current branch to origin without a diff review or confirmation. This can publish secrets, unrelated files, or unintended code.","confidence_reasoning":"The code directly runs git add, git commit, and git push in sequence. No review or confirmation step appears between these operations."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"32a3795818eaa3bf4e46f30fc296fe1568a9ae4b9ca01f478bac150e7eb4bec6","subject_tree_hash":"9e6e0206a086ad95fc834a3812020cc764ab896beec333d553663a8a48470cf6","subject_plugin_path":"skills/sickn33/git-pushing","audit_payload_hash":"10a63bdd8936e886c64987f0f31bef73","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"32a3795818eaa3bf4e46f30fc296fe1568a9ae4b9ca01f478bac150e7eb4bec6","treeHash":"9e6e0206a086ad95fc834a3812020cc764ab896beec333d553663a8a48470cf6","pluginPath":"skills/sickn33/git-pushing","auditPayloadHash":"10a63bdd8936e886c64987f0f31bef73"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-git-pushing/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}