Git Deployer

Push static site content to GitHub Pages repositories. Clone, copy files, commit with timestamp, force-push. Use when updating GitHub Pages sites, deploying...

Security Scan

The skill's behavior matches its stated purpose (cloning a repo, mirroring files, committing, and force-pushing), but there are small inconsistencies and safety concerns you should consider before installing.

Purpose & Capability

The name/description align with the included script: it clones a repo, copies files, commits, and force-pushes. However the registry metadata declares no required binaries while the SKILL.md and script clearly require git (and the script also uses rsync). The absence of declared dependencies is an inconsistency.

Instruction Scope

SKILL.md and scripts only operate on the provided site_path and remote_url, and do not access other environment variables or remote endpoints. Concerns: it force-pushes (destructive on shared branches), it clones into /tmp and intentionally does not clean up (may leave sensitive content on disk), and the script relies on rsync but SKILL.md doesn't mention it. The script also may behave unexpectedly for scp-style URLs (basename handling).

Install Mechanism

No install spec (instruction-only plus a shell script). Nothing is downloaded or installed by the skill itself, lowering installation risk.

Credentials

The skill requests no environment variables or credentials in the registry, but it implicitly requires local git credentials (SSH keys or an HTTPS token/credential helper) to push to remotes. That is proportionate to its purpose but should be noted because the skill will use whatever git auth you have configured.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does persist data by creating a /tmp/<reponame> clone and intentionally does not remove it; this is a design choice rather than a platform-privilege issue.

What to consider before installing

This skill appears to do what it says, but review these before installing: (1) Ensure you understand and accept that the script uses --force push (it will overwrite remote branch history). (2) Confirm git and rsync are installed and your local git credentials (SSH key or HTTPS token) are correctly configured; the registry does not declare these dependencies. (3) Be aware clones are left under /tmp/<reponame> for inspection — remove them if they contain sensitive data. (4) Test with a throwaway repository or branch first to verify behavior (and to confirm the script handles your remote URL format correctly). If you need the registry metadata to be accurate, ask the publisher to declare required binaries (git, rsync) and to document the /tmp behavior and force-push risks.

Deploy static site content to GitHub Pages or any git-backed host.

When to Use

• GitHub Pages updates — You have a local build/output directory and want to push it to a username.github.io repo or a Pages branch (gh-pages, main)
• Static site deployment — Hugo, Jekyll, Gatsby, Docusaurus, or any static site with a git-hosted output
• Automated CI replacement — Instead of setting up GitHub Actions, you want a one-command deploy from your machine
• Syncing local → remote — You edit content locally and need to push changes to a hosted git repository

Workflow

Local Site Directory → /tmp/clone → File Copy → Commit → Force Push → Done

1. Clone or init — If the remote repo exists, clone it to /tmp/{reponame}. Otherwise initialize a fresh clone
2. Copy files — Sync your local site directory contents into the clone (clean copy, not append)
3. Commit — Stage all files, commit with auto-generated timestamp message
4. Force push — Push to remote with force flag to overwrite remote state
5. Report — Output success/failure with commit hash and push result

Usage

Via skill invocation (from agent)

Provide the following arguments:

• site_path — Absolute path to the local site directory (the content to deploy)
• remote_url — Full git URL (e.g., https://github.com/user/repo.git or [e-mail]:user/repo.git)
• branch — Branch to deploy to (default: main)

Via script directly

./scripts/deploy.sh /path/to/site [e-mail]:user/repo.git [branch]

Output

• Success — Shows commit hash, remote URL, branch, and push status
• Failure — Shows error message with exit code and which step failed

Requirements

• git must be installed and configured with credentials for the remote
• SSH key or HTTPS token auth must be set up for the remote repository
• Site path must exist and contain files

Notes

• Uses --force push — this will overwrite remote state. Use with caution on shared branches
• Clone happens in /tmp and is not cleaned up automatically (intentional: allows inspection)
• Commit message format: Deploy: YYYY-MM-DD HH:MM:SS UTC