Security audit
Security checks for vulnerabilities and agentic risk
This is a small git workflow convention skill that gives disclosed commit and push guidance without hidden code, persistence, or data access.
Install this only if you want your agent to follow these git conventions, including English commit messages, signed-off commits, and prompting about pushing after local commits. Review whether those workflow rules match your repository before relying on it.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
1. **Language**: Use English only for git commit messages.
2. **Force Push**: Always confirm before `git push --force`.
3. **Sign-off**: Include `--signoff` flag with all commits.
The description says to use the skill when 'making git commits, pushing changes, or performing git operations.' The phrase 'performing git operations' is very broad and overlaps with many ordinary repository actions, making it unclear when the skill should or should not activate.
The instruction 'Use English only for git commit messages' imposes a language policy unconditionally. This is a natural-language policy concern because it forces a specific language without opt-in, alternative support, or a documented regional/compliance reason.
No suspicious patterns detected.