Skills git-push

📦

git-push

Name: git-push
Author: yunshu0909

Content revision r1 Medium Risk ⚙️ External commands

Push Projects to GitHub Safely

Publishing a local project can expose secrets or fail because of large files. This skill guides GitHub setup, push, and release steps with checks and confirmations.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "git-push" from https://skillstore.io/skills/yunshu0909-git-push.md and its manifest at https://skillstore.io/api/skills/yunshu0909-git-push/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/yunshu0909-git-push.md Signed manifest GET /api/skills/yunshu0909-git-push/manifest Signed lockfile GET /api/skills/yunshu0909-git-push/lockfile

Test it

Using "git-push". Push this new project to GitHub as private.

Expected outcome:

The skill reports environment checks, shows proposed exclusions, creates a private repository, and confirms the first push.

Using "git-push". Push my latest changes.

Expected outcome:

The skill summarizes changed files, warns about any new large files, creates a concise commit, and confirms the push result.

Using "git-push". Create a release with the build archive.

Expected outcome:

The skill suggests a version, drafts release notes from commits, asks before upload, and reports the release URL.

Security Audit

Medium Risk

v5 • 7/8/2026 Open versioned report

Most static findings are Markdown formatting false positives, including the sensitive-file and entropy alerts. Several git and GitHub CLI workflows are confirmed because they can publish local files, mutate repository history, or upload release assets. No prompt injection text was found in the reviewed skill file.

Files scanned

391

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:151-153 SKILL.md:171-178 SKILL.md:253-258

Repository Publication Can Expose Local Files

The skill can create public or private GitHub repositories and push project contents. Its confirmations reduce risk, but public publication can expose local files if review is incomplete.

The workflow explicitly creates repositories, pushes branches, and uploads release assets to GitHub. The instructions include checks, so the issue is controlled but still real.

Medium

SKILL.md:61-63 SKILL.md:297-299

Destructive Git History Operations

The workflow includes deleting local Git history and force pushing remote history after confirmation. These actions can cause data loss if the user confirms the wrong target.

The text directly describes deleting .git and warns that the action is unrecoverable. The same section requires confirmation, which limits but does not remove the risk.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:201-203

Ruby/shell backtick execution

| 仍然失败 / 远程有冲突 | 历史不兼容 | 问用户"是否强制覆盖远程?" ⚠️ 告知:"这将覆盖远程所有内容,仅在确认远程内容可以丢弃时使用"→ `git push --force` |

git push --force can overwrite remote history and discard other work. The skill requires confirmation, but this is a real destructive repository operation.

Medium

SKILL.md:51-64

Ruby/shell backtick execution

```

The workflow includes a path that deletes the .git directory after user confirmation, which can destroy local history. It is documented as opt-in, but the operation is still security-sensitive.

Medium

SKILL.md:156-171

Ruby/shell backtick execution

- 执行 `gh repo view [账号]/[仓库名]` 检查

The workflow directs use of gh repo view with a selected account and repository name. This is intended GitHub CLI use, but it still invokes an external command and should validate arguments.

Medium

SKILL.md:171-179

Ruby/shell backtick execution

```

This block instructs git init, git add, git commit, gh repo create, and git push. These commands modify local repository state and upload project contents to GitHub.

Medium

SKILL.md:183-194

Ruby/shell backtick execution

```

The daily update flow uses git add -A, commit, and push, which can stage and publish all local changes. The workflow includes checks, but the operation remains security-sensitive.

Medium

SKILL.md:200

Ruby/shell backtick execution

| `rejected (fetch first)` 或 `non-fast-forward` | 远程有本地没有的提交 | 默认执行 `git pull --rebase` 后重试 |

The failure path defaults to git pull --rebase, which mutates local repository history and working state. It is a legitimate recovery action but should be explicit to the user.

Medium

SKILL.md:253-259

Ruby/shell backtick execution

```

The release flow creates tags, pushes them, creates GitHub Releases, and can upload a user-supplied file. That intentionally publishes artifacts and needs consent and path review.

Risk Factors

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/yunshu0909-git-push/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/yunshu0909-git-push/security.svg)](https://skillstore.io/skills/yunshu0909-git-push?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/yunshu0909-git-push?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/yunshu0909-git-push/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/yunshu0909-git-push.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

yunshu0909. (2026). git-push security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/yunshu0909-git-push/audits/5

BibTeX citation

@techreport{yunshu0909-yunshu0909-git-push-2026,
  author = {yunshu0909},
  title = {git-push security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/yunshu0909-git-push/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "git-push security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "yunshu0909"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/yunshu0909-git-push/audits/5"
identifiers:
  - type: other
    value: "skillstore:yunshu0909-git-push:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Publish a New Project

Create a GitHub repository, prepare .gitignore, make the first commit, and push the main branch.

Push Daily Updates

Review changed files, check new large files, create a clear commit, and push to the existing remote.

Create a GitHub Release

Suggest a version tag, summarize commits, create a release, and attach approved files.

Try These Prompts

Publish a New Project

Push this project to GitHub as a private repository. Use the current folder name unless I choose another name.

Push Current Changes

Push my current changes to the existing remote. Check new large files and generate a clear commit message.

Prepare a Public Repository

Publish this project as a public GitHub repository. First review .gitignore, large files, and sensitive filenames with me.

Create a Release With Assets

Create the next GitHub Release from the latest commits. Suggest a version, generate notes, and ask before uploading any asset.

Best Practices

Review the .gitignore changes and exclusion list before the first commit.
Use private visibility until sensitive content review is complete.
Confirm the target GitHub account, repository name, and release assets before publishing.

Avoid

Do not publish a public repository before checking for secrets and private files.
Do not force push unless the remote history can be safely discarded.
Do not upload release attachments that you have not reviewed.

Frequently Asked Questions

What tools does this skill require?

It requires git and the GitHub CLI. The GitHub CLI must be logged in before repository operations.

Can it create a new GitHub repository?

Yes. It can create a new repository or link the current project to an existing repository.

Does it prevent secrets from being published?

It checks sensitive filename patterns and asks for confirmation. It is not a full secret scanner.

How does it handle large files?

It warns about files over 10 MB and blocks single files over the GitHub 100 MB limit.

Can it publish public repositories?

Yes. It adds extra review steps before public publication and asks for explicit confirmation.

Can it create GitHub Releases?

Yes. It can suggest a version, create a tag, draft notes, and upload approved attachments.

Developer Details

Author

yunshu0909

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/yunshu0909/yunshu_skillshub/tree/master/git-push

Ref

64ca8af0f54a325752f08bd54e52151061ea659a

Maintenance freshness

7/20/2026

Usage

16 downloads · 147 views

File structure

📄 SKILL.md