Post Merge Rename

• Risk level: Medium
• Analyzed: May 10, 2026, 5:12 PM
• Findings: 3
• Version: 1.9.72

Overview

This skill is purpose-aligned, but its default behavior can bulk rename local branches and change/delete branch names on the remote Git repository without an explicit confirmation step.

Install or run this only if you intentionally want automated post-merge branch renaming in the current Git repository. Start with `--dry-run`, verify the exact branches and origin remote, and make sure your team is comfortable with the old remote branch names being deleted after renamed branches are pushed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Medium

What this means

Running the skill in the wrong repository, or before reviewing the branch list, could change shared remote branch names and disrupt teammates, CI jobs, or branch-based workflows.

Why it was flagged

The default scan path can rename all merged local branches, push new branch names to origin, and delete the old remote branch names without an explicit confirmation step.

Skill content

merged=$(git branch --merged main ...)
...
git branch -m "$trimmed" "$new_name" 2>/dev/null || true
git push origin "$new_name" 2>/dev/null || true
git push origin --delete "$trimmed" 2>/dev/null || true

Recommendation

Make dry-run the default, require explicit user confirmation before pushing or deleting remote refs, and prefer an explicit branch argument for remote mutations.

ASI09: Human-Agent Trust Exploitation

Low

What this means

A user may underestimate the impact because the wording suggests no deletion occurs, even though the old remote branch name is removed from origin.

Why it was flagged

The script contains a reassuring 'Never deletes branches' claim while also deleting the old remote branch ref as part of the remote rename process.

Skill content

# Never deletes branches. Only renames.
...
git push origin --delete "$trimmed" 2>/dev/null || true

Recommendation

Clarify that remote renaming is implemented by pushing the new ref and deleting the old remote ref, and state the collaboration impact plainly.

ASI03: Identity and Privilege Abuse

Low

What this means

The skill can perform whatever branch push/delete actions the current Git credentials are allowed to perform.

Why it was flagged

These commands use the user's configured Git remote access to mutate branches on origin.

Skill content

git push origin "$new_name" 2>/dev/null || true
...
git push origin --delete "$trimmed" 2>/dev/null || true

Recommendation

Run it only in repositories where you intend to allow branch ref changes, and use Git branch protections or least-privilege credentials where possible.