Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only Git workflow coaching skill that is broad but purpose-aligned and does not hide destructive, persistent, or exfiltrating behavior.
Install this if you want an assistant to be more assertive about Git hygiene. Expect it to prompt about branches, commits, and safety checks across Git repositories; review or disable it if that level of automatic workflow coaching would interfere with your projects.
The README says the skill 'activates automatically' and applies when 'working in any git repository' and at broad moments like 'completing a module or feature.' These conditions are not narrowly scoped and lack exclusion criteria or negative examples, so the skill could trigger during ordinary repository activity beyond the user's intent.
The manifest description activates the skill for very broad situations like 'working in a git repository,' 'start new work,' or deciding 'what branch to work on.' These conditions are common across routine development and do not define clear boundaries or exclusions, increasing the chance of over-invocation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Committing directly to main | Always create a branch first |
| Commit message "fix stuff" | Describe the specific change |
| Pushing immediately after commit | Accumulate, verify, then push |
| Force push without checking | Run safety checklist first |
| Skipping branch for "small fix" | Small fixes go on `fix/` branches too |
| Amend pushed commits | Only amend local, unpushed commits |
The file presents bilingual documentation, but the described runtime behavior includes proactive prompts like '要 commit 吗？' and 'Ready to commit?' without specifying that the user can choose the interaction language. Because the skill describes automated user-facing messages, the absence of an explicit language preference mechanism may conflict with language-choice expectations.