Skills conductor-revert
📦
conductor-revert
Content revision r1 High Risk ⚙️ External commands
Revert Conductor Work Safely
Git reversions can be hard to scope when work is grouped by tracks, phases, and tasks. This skill guides safe commit discovery, confirmation, git revert execution, and Conductor status updates.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "conductor-revert" from https://skillstore.io/skills/sickn33-conductor-revert.md and its manifest at https://skillstore.io/api/skills/sickn33-conductor-revert/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "conductor-revert". Revert dashboard_20250112 task 2.3.
Expected outcome:
The skill identifies task commits, lists affected files, explains plan status changes, and waits for exact YES before modifying the repository.
Using "conductor-revert". Roll back phase 1 of auth_20250115.
Expected outcome:
- The skill groups matching task commits for the phase.
- It shows which Conductor plan entries will return to pending.
- It stops if conflicts appear and asks for manual resolution.
Using "conductor-revert". Undo a revert that caused problems.
Expected outcome:
The skill explains safer recovery choices first, warns about destructive alternatives, and recommends verification before continuing.
Security Audit
High Riskv4 • 7/6/2026 Open versioned report
The static Ruby backtick alerts are mostly Markdown inline code and fenced examples, not executable Ruby. I confirmed the findings that instruct agents to run git status, git log, git revert, or other git commands, and added semantic findings for unvalidated placeholder input and destructive rollback guidance. No prompt injection text was found in SKILL.md.
1
Files scanned
373
Lines analyzed
9
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unvalidated Input in Shell Command Templates
The skill accepts track, phase, and task arguments, then shows shell command templates that interpolate those values into git log and grep commands. Without strict validation or argv-style execution, crafted identifiers could alter command behavior.
The argument formats are user-selected and the later command examples reuse placeholders inside shell commands. The file does not require regex validation or non-shell argument execution.
High
Destructive Rollback Guidance
The undo section presents reset and checkout commands that can discard local working-tree changes after a revert operation. The warning helps, but the skill still offers a destructive recovery path.
The cited section explicitly includes reset and checkout as an alternative flow and states that it discards revert commits. The risk depends on user choice, so confidence is high but not absolute.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```
The undo section presents git revert, git reset --soft, and git checkout commands. The reset and checkout flow can discard working-tree changes if used incorrectly, making this a destructive command risk.
Medium
Ruby/shell backtick execution
- Run `git status` to confirm git repo
The skill instructs the agent to run git status on the local repository. This is a legitimate preflight check, but it is still external command execution that reads repository state.
Medium
Ruby/shell backtick execution
```bash
The cited range contains a git log command with user-provided track and task placeholders. It runs an external command and can expose command-injection risk if values are not validated before shell execution.
Medium
Ruby/shell backtick execution
```bash
The cited range contains a git log command that interpolates track and task placeholders. It is legitimate git discovery, but still executes a local shell command with user-derived values.
Medium
Ruby/shell backtick execution
```bash
The cited range contains a shell pipeline using git log and grep with placeholders. The pipeline uses external commands and can become unsafe if the track or phase values are not constrained.
Medium
Ruby/shell backtick execution
```bash
The cited range contains git log with a user-supplied track placeholder. It is expected for commit discovery, but it remains external command execution over repository history.
Medium
Ruby/shell backtick execution
```bash
The cited range contains a git log command over a Conductor track directory. This is a local external command that depends on a user-selected track identifier.
Medium
Ruby/shell backtick execution
```
The cited block directs execution of repeated git revert --no-edit commands. These commands modify repository history by creating revert commits, so user confirmation and validation are security-relevant.
Medium
Ruby/shell backtick execution
```
The verification text includes guidance to run tests and use a git revert range if problems are found. This is optional troubleshooting text, but it still instructs external command execution.
Risk Factors
⚙️ External commands (48)
SKILL.md:27 SKILL.md:32 SKILL.md:33 SKILL.md:36 SKILL.md:40-50 SKILL.md:50-63 SKILL.md:63-65 SKILL.md:65-68 SKILL.md:68-70 SKILL.md:70-73 SKILL.md:73-75 SKILL.md:75-82 SKILL.md:82-98 SKILL.md:98-106 SKILL.md:106-108 SKILL.md:108-112 SKILL.md:112-114 SKILL.md:114-123 SKILL.md:123-125 SKILL.md:125-135 SKILL.md:135-137 SKILL.md:137-141 SKILL.md:141-143 SKILL.md:143-151 SKILL.md:151-187 SKILL.md:187-195 SKILL.md:195-213 SKILL.md:213-219 SKILL.md:219-238 SKILL.md:238-248 SKILL.md:248 SKILL.md:249 SKILL.md:252-253 SKILL.md:253-254 SKILL.md:254-262 SKILL.md:262 SKILL.md:267 SKILL.md:273-302 SKILL.md:302-306 SKILL.md:306 SKILL.md:307-318 SKILL.md:318-328 SKILL.md:328-332 SKILL.md:332-339 SKILL.md:339-343 SKILL.md:343-354 SKILL.md:354-360 SKILL.md:360-372
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-conductor-revert/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-conductor-revert?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-conductor-revert?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-conductor-revert/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-conductor-revert.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). conductor-revert security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-conductor-revert/audits/4BibTeX citation
@techreport{sickn33-sickn33-conductor-revert-2026,
author = {sickn33},
title = {conductor-revert security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-conductor-revert/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "conductor-revert security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-conductor-revert/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-conductor-revert:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Undo One Completed Task
Identify the commits for a single Conductor task and prepare a scoped revert plan.
Roll Back a Phase
Review all task commits in one phase and reset related plan status after reversal.
Reverse a Full Track
Find every commit for a track and coordinate a full revert with clear warnings.
Try These Prompts
Revert a Task
Use conductor-revert for track dashboard_20250112 task 2.3. Show the revert plan and wait for exact YES before any changes.
Review a Phase Revert
Use conductor-revert to inspect phase 2 of auth_20250115. List matching commits, affected files, and plan updates before execution.
Prepare Full Track Rollback
Use conductor-revert to prepare a full rollback for payments_20250120. Include remote status, pushed commits, and verification steps.
Recover After Conflict
A revert stopped with a merge conflict. Use conductor-revert to summarize completed reverts, conflicted files, and safe next actions.
Best Practices
- Review the full revert plan before approving any repository changes.
- Validate track, phase, and task identifiers before running git commands.
- Run the project test suite and inspect Conductor status after completion.
Avoid
- Approving a revert without checking the affected files and commits.
- Using the undo guidance to discard local work without a backup.
- Running this workflow outside a clean git repository.
Frequently Asked Questions
Does this skill use git reset hard?
No. The safety rules prohibit git reset hard and prefer git revert for history preservation.
Can it revert a single task?
Yes. It accepts a track and task reference, then finds matching task and plan update commits.
What happens if a merge conflict occurs?
The skill halts immediately, reports conflicted files, and asks for manual resolution or investigation.
Does it update Conductor plan files?
Yes. It guides updates to plan.md, metadata.json, and tracks.md after successful reverts.
Can it find every commit automatically?
Not always. It depends on commit messages and track paths that match the expected Conductor format.
Is user confirmation required?
Yes. The skill requires the exact word YES before proceeding with revert operations.