Git Helper

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only Git workflow helper, but it can guide real repository changes such as commits, rebases, resets, and pushes.

Before installing, be comfortable with the agent helping run Git workflows. Ask it to show status and diffs before staging or committing, and require explicit approval before rebases, resets, force pushes, or pushes to shared branches.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the agent could help commit, rebase, reset, or push changes that affect your project history or remote repository.

Why it was flagged

The skill documents Git operations that can stage broad changes, publish to remotes, or alter history. This is expected for a Git helper, and the safety rules mitigate the risk by requiring status checks and confirmation for destructive actions.

Skill content

- `git add -A` - Stage all changes
- `git push` - Push to remote ...
3. **Confirm destructive actions** (rebase, reset, hard, force push)

Recommendation

Review `git status`, diffs, branch names, and remote targets before allowing commits, rebases, resets, or pushes.

Low

#ASI03: Identity and Privilege Abuse

What this means

A push could affect a remote repository using your existing Git permissions.

Why it was flagged

Remote pushes may use the user's configured Git access and can publish changes under that identity. This is purpose-aligned for Git automation, and the artifacts do not show credential collection or leakage.

Skill content

- `git push` - Push to remote (default: current branch)

Recommendation

Confirm the repository, branch, and commit contents before pushing, especially for shared or public repositories.