Claude Code, Skill
Git Workflow Skill
Git workflow best practices with commit validation hooks
Compatibility: Not stated.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 2e058db3fdb2.
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 35
prepare - SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/git-workflow/references/advanced-git.md, line 2027
`~/.ssh/config`, every git command to a host reuses one backgrounded master
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/test_promoted_gates.py, line 45
result = subprocess.run(
scripts/test_promoted_gates.py, line 80
subprocess.run(["git", "-C", self.repo, "init", "-q"], check=True)
scripts/test_promoted_gates.py, line 82
subprocess.run(["git", "-C", self.repo, "add", "tracked.txt"], check=True)
Show more
scripts/test_promoted_gates.py, line 83
subprocess.run(
scripts/test_promoted_gates.py, line 102
shutil.rmtree(self.repo, ignore_errors=True)
scripts/test_promoted_gates.py, line 105
result = subprocess.run(
scripts/test_reference_worktree_gate.py, line 149
p = subprocess.run(
scripts/test_validate_git_command.py, line 41
result = subprocess.run(
scripts/test_validate_git_command.py, line 327
result = subprocess.run(
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 35
prepare
Network
Concern
can reach a host that is not written as a fixed address. can reach sonarcloud.io. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
scripts/validate_git_command.py, line 85
# and only a segment that actually invokes gh/curl counts — matching the path
scripts/validate_git_command.py, line 89
# in an echo or a commit message. But anchoring on gh/curl alone let any
skills/git-workflow/references/merge-gate-watcher.md, line 73
curl -s -H "$AUTH" "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$KEY&pullRequest=$PR" \
Show more
skills/git-workflow/references/merge-gate-watcher.md, line 75
curl -s -H "$AUTH" "https://sonarcloud.io/api/issues/search?componentKeys=$KEY&pullRequest=$PR&resolved=false&ps=1" | jq .total
skills/git-workflow/references/merge-gate-watcher.md, line 85
curl -s -H "$AUTH" "https://sonarcloud.io/api/measures/component_tree?component=$KEY&pullRequest=$PR&metricKeys=new_duplicated_lines&ps=200" \
skills/git-workflow/references/merge-gate-watcher.md, line 88
curl -s -H "$AUTH" "https://sonarcloud.io/api/duplications/show?key=$KEY%3A<path>&pullRequest=$PR" \
skills/git-workflow/references/merge-gate-watcher.md, line 454
code=$(curl -s --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' "$URL")
skills/git-workflow/SKILL.md, line 41
| `references/advanced-git.md` | Rebase (incl. non-interactive `rebase -i`), cherry-pick, bisect, stash, worktrees, reflog, hanging push/fetch (SSH mux) |
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/git-workflow/references/advanced-git.md, line 2027
`~/.ssh/config`, every git command to a host reuses one backgrounded master
skills/git-workflow/scripts/verify-git-workflow.sh, line 125
COMMON_IGNORES=("node_modules" ".env" "*.log" "dist" "build" ".DS_Store")
skills/git-workflow/checkpoints.yaml, line 20
pattern: ".env"
Show more
skills/git-workflow/checkpoints.yaml, line 22
desc: ".gitignore should exclude .env files"
skills/git-workflow/references/advanced-git.md, line 620
caches, a local `.env`, and whatever a job or a script wrote into the worktree.
skills/git-workflow/references/advanced-git.md, line 624
Measured on git 2.55.0: a worktree holding an ignored `.env` and an ignored
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
skills/git-workflow/references/pull-request-workflow.md, line 1
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 2e058db3fdb2. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach sonarcloud.io. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read. no licence file found.
Date and source
Date checked:
github.com
Commit graded: 2e058db3fdb203058d7ad5ca85a925aba1bdc88a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.