Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Git workflow helper; it can affect repositories if used, but the behavior is visible and aligned with its purpose.
Install this if you want Codex to help with Git workflows. Review commands before allowing commits, pushes, rebases, branch deletion, or PR/MR creation, especially because the skill uses broad Git triggers and includes example project paths and repository conventions that may not fit every project.
The trigger list is broad enough to activate on routine discussion of Git concepts rather than a clear request to use this skill. In an agent setting, that can cause unintended skill invocation and execution of repository-affecting commands in contexts where the user only wanted advice, increasing the chance of unwanted branch changes, pulls, commits, or pushes.
The skill prescribes branch prefixes like 'feature/' and 'fix/' and English conventional commit labels such as 'feat:' and 'fix:' as required norms. This can be a locale/language policy issue when presented as a mandatory convention without user opt-in or explanation that the repository specifically requires English naming.
No suspicious patterns detected.
