📦

ru

Name: ru
Author: Dicklesworthstone

Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Synchronize Git repositories at scale

Managing many repositories creates drift, stale branches, and missed review work. This skill guides Repo Updater workflows for syncing, auditing, and coordinating AI-assisted repository maintenance.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "ru" from https://skillstore.io/skills/dicklesworthstone-ru.md and its manifest at https://skillstore.io/api/skills/dicklesworthstone-ru/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dicklesworthstone-ru.md Signed manifest GET /api/skills/dicklesworthstone-ru/manifest Signed lockfile GET /api/skills/dicklesworthstone-ru/lockfile

Test it

Using "ru". How do I safely sync all repos?

Expected outcome:

Start with a dry run, inspect skipped and diverged repositories, then run a parallel sync only after confirming the update strategy.

Using "ru". What should I check before agent-sweep?

Expected outcome:

Confirm the repo denylist covers secrets and build artifacts.
Use warn or block mode for secret scanning.
Review generated commit plans before applying them.

Using "ru". Can this help with open PRs?

Expected outcome:

Yes. It describes a review planning mode that queries GitHub issues and PRs, scores priorities, and prepares isolated worktrees.

Security Audit

Critical

v10 • 7/9/2026 Open versioned report

Most static findings are false positives caused by Markdown examples, inline command names, XDG paths, and protective denylist entries. The main confirmed risks are the curl-to-bash installer and broad automation that can commit, push, tag, or release across repositories.

Files scanned

504

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

SKILL.md:481

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/repo_updater/main/install.sh | bash

The documented installer pipes a remote shell script directly into bash. This is a real supply-chain risk because downloaded code executes before the user can inspect it.

High

SKILL.md:123-126 SKILL.md:206-215

Automated Repository Write Operations

The skill describes workflows where AI agents can stage files, create commits, optionally push changes, create tags, and publish GitHub releases across many repositories. This is powerful but can affect shared repositories if applied without explicit review and confirmation.

The documented workflow explicitly includes staging, committing, optional pushing, tag creation, and optional GitHub releases. The risk is operational intent rather than a single static code pattern.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:479-485

Ruby/shell backtick execution

```bash

This Markdown command block includes the remote curl-to-bash installer. The Ruby backtick label is inaccurate, but the documented shell command is risky if followed.

High

SKILL.md:481

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/repo_updater/main/install.sh | bash

The URL is part of a remote installer command that fetches code from GitHub for immediate execution. Hardcoded GitHub URLs alone can be safe, but this one participates in an install flow.

Risk Factors

⚙️ External commands (50)

SKILL.md:15 SKILL.md:27-35 SKILL.md:35-41 SKILL.md:41-44 SKILL.md:44-46 SKILL.md:46-48 SKILL.md:48-54 SKILL.md:54-69 SKILL.md:69-73 SKILL.md:73-79 SKILL.md:79-83 SKILL.md:83-102 SKILL.md:102-106 SKILL.md:106-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-126 SKILL.md:126-128 SKILL.md:128-134 SKILL.md:134-152 SKILL.md:152-153 SKILL.md:153-154 SKILL.md:154-156 SKILL.md:156-159 SKILL.md:159-163 SKILL.md:163-168 SKILL.md:168-172 SKILL.md:172-176 SKILL.md:176-197 SKILL.md:197-201 SKILL.md:201-206 SKILL.md:206-212 SKILL.md:212 SKILL.md:219-223 SKILL.md:223-231 SKILL.md:231-232 SKILL.md:232-233 SKILL.md:233-234 SKILL.md:234-235 SKILL.md:235-236 SKILL.md:236-237 SKILL.md:237-238 SKILL.md:238-246 SKILL.md:246 SKILL.md:247 SKILL.md:248 SKILL.md:249 SKILL.md:253-257 SKILL.md:257-263 SKILL.md:263-264

🌐 Network access (3)

SKILL.md:89 SKILL.md:299 SKILL.md:481

📁 Filesystem access (20)

🔑 Env variables (2)

SKILL.md:443 SKILL.md:452

Detected Patterns

Pipe to shell pattern

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dicklesworthstone-ru/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dicklesworthstone-ru/security.svg)](https://skillstore.io/skills/dicklesworthstone-ru?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dicklesworthstone-ru?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dicklesworthstone-ru/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dicklesworthstone-ru.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dicklesworthstone. (2026). ru security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dicklesworthstone-ru/audits/10

BibTeX citation

@techreport{dicklesworthstone-dicklesworthstone-ru-2026,
  author = {Dicklesworthstone},
  title = {ru security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/dicklesworthstone-ru/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ru security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "Dicklesworthstone"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dicklesworthstone-ru/audits/10"
identifiers:
  - type: other
    value: "skillstore:dicklesworthstone-ru:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Maintain many repositories

Run planned sync and status workflows across personal, forked, or dependency repositories.

Coordinate AI review work

Plan and apply AI-assisted reviews while using worktrees, quality gates, and runtime budgets.

Clean dirty working trees

Preview and process repositories with uncommitted changes using denylist and secret-scan guardrails.

Try These Prompts

Check repository status

Use the ru skill to explain how I can check the status of all configured repositories without modifying them.

Plan a safe sync

Help me plan a dry-run sync for my configured repositories, including JSON output and what warnings I should review first.

Review AI-assisted changes

Guide me through ru review --plan and ru review --apply, including quality gates and when pushing should require confirmation.

Design an agent sweep policy

Help me configure an agent-sweep workflow for dirty repos with secret scanning, denylist rules, timeouts, and release controls.

Best Practices

Run status and dry-run commands before any sync, prune, push, or release operation.
Keep secret scanning enabled and review denylist coverage before committing agent-selected files.
Use explicit runtime, repository, and parallelism limits for large multi-repo operations.

Avoid

Do not pipe remote install scripts into a shell without independent review.
Do not use force, delete, push, or release options without clear user confirmation.
Do not let automated agents stage files that match secret, credential, or build-artifact patterns.

Frequently Asked Questions

What does this skill help with?

It helps users operate Repo Updater for multi-repository GitHub synchronization and AI-assisted maintenance workflows.

Does it modify repositories by default?

Some documented commands are read-only, but sync, apply, prune, push, and release workflows can modify repositories.

Does it support Claude Code?

Yes. The skill describes Claude Code sessions managed directly or through ntm robot mode.

Can it process dirty repositories?

Yes. The agent-sweep workflow can plan, commit, and optionally release changes after preflight checks.

What are the main security concerns?

The main concerns are remote install scripts, repository write operations, credential handling, and automated agent commits.

Is this a complete CLI implementation?

No. This skill provides operational guidance for an external CLI rather than the full source code.

Developer Details

Author

Dicklesworthstone

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Dicklesworthstone/agent_flywheel_clawdbot_skills_and_integrations/tree/main/skills/ru

Ref

1ffa7643651792ccb4bd3b15d924d2c97edff755

Maintenance freshness

7/23/2026

Usage

5 downloads · 221 views

File structure

📄 SKILL.md