Security audit
Security checks for vulnerabilities and agentic risk
This is a Git guidance skill with some risky Git commands documented, but no hidden code, automatic execution, or unrelated behavior.
Install only if you want Git workflow advice, and treat its destructive examples as commands that require confirmation: avoid force-pushing shared or protected branches, and do not run `git reset --hard` unless you have checked `git status` and are sure you want to discard local work.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
git checkout -b feat/my-feature main
# ... code, commits ...
git push -u origin feat/my-feature
# → Open PR on GitHub/GitLab/Azure DevOps
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Recovery
- **Undo last commit (keep changes)**: `git reset --soft HEAD~1`
- **Undo last commit (discard changes)**: `git reset --hard HEAD~1`
- **Recover deleted branch**: `git reflog` → find SHA → `git checkout -b <branch> <sha>`
- **Undo a pushed commit**: `git revert <sha>` (safe for shared branches)
The workflow recommends git push --force-with-lease after rebasing, but does not warn that even the safer force-push variant rewrites remote history and can disrupt collaborators if used on shared branches. In a guidance skill, lack of contextual guardrails can lead users to apply the pattern broadly, causing loss of others' commits or repository confusion.
The skill documents git reset --hard HEAD~1 as a recovery option without any warning that it irreversibly discards uncommitted and committed changes from the working tree/history context. In an assistant setting, users may copy-paste commands directly, so omission of safety guidance materially increases the risk of accidental data loss.
No suspicious patterns detected.