Git Workflow Assistant

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If a user runs these commands in the wrong repository or branch, they could lose local work or disrupt shared Git history.

Why it was flagged

These documented Git commands can rewrite remote branch history or discard local changes. They are expected for advanced Git workflow guidance, but they require user care.

Skill content
`git push --force-with-lease`; `git reset --hard HEAD~1`
Recommendation

Run destructive or history-rewriting Git commands only after checking `git status`, confirming the target branch, and understanding whether the branch is shared.

What this means

Global aliases affect Git usage across repositories and may surprise users later if they forget the aliases exist.

Why it was flagged

The skill suggests persistent global Git configuration changes. This is a normal Git customization pattern, not hidden background behavior, but it changes future Git behavior until removed.

Skill content
git config --global alias.undo "reset --soft HEAD~1"
Recommendation

Only add global aliases you want permanently; use local repository config or document the change if you prefer scoped behavior.

What this means

Users cannot easily verify the author, upstream project, or update history outside the registry metadata.

Why it was flagged

The registry entry does not identify an upstream source or homepage. Because this is instruction-only with no install code, the practical supply-chain risk is low, but provenance is limited.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the included text before use and prefer skills with clear provenance when installing more powerful or executable skills.