stash-shelve — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited stash-shelve (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
How should temporary work be safely shelved, restored, or inspected without losing user changes or staged boundaries?
Use this skill when:
Do not use this skill when:
Route to:
undo-recoverresolve-conflictsatomic-commitssync-branchBefore action, inspect or establish:
No-evidence rule:
You MAY:
You MUST:
You MUST NOT:
| State | Evidence | Risk | Default Action | Confirmation | Verification |
|---|---|---|---|---|---|
| Inspect stash | stash list/show requested | R0/R1 | Report stash metadata and changed paths | no | stash ref summarized |
| Create stash for tracked work | dirty tracked files and explicit request | R2 | Create named stash preserving scope | no if explicit | stash list and status |
| Include untracked files | untracked list and explicit request | R3 | Require explicit inclusion confirmation | yes | stash show and status |
| Apply stash | target stash and current status | R3 | Prefer apply over pop; verify before drop | yes | status after apply |
| Drop or pop stash | stash target | R5 | Require exact stash ref and verification plan | yes + recovery | stash list after action |
stash apply over pop when safety matters.Trigger:
Default: <!-- guardrail:stash.default-apply-not-pop -->
git stash apply stash@{n} semantics first; keep the stash entry until restored state is verified.Must: <!-- guardrail:stash.inspect-before-apply-drop -->
git stash list, git stash show --stat stash@{n}, and current git status --short before apply/drop when a target stash is involved.git stash drop.Must not: <!-- guardrail:stash.no-pop-for-apply -->
git stash pop when the user only asked to apply or restore.git stash drop stash@{n} after apply-only requests.Requires explicit confirmation:
Verification:
git stash list still contains the stash after apply-only, or no longer contains it after confirmed drop.Minimum verification:
resolve-conflicts.Risk-based floor:
Final response must include:
## Result
- Decision, action, or artifact produced.
## Evidence
- Files, commands, diffs, refs, or assumptions used.
## Verification
- Checks performed and their result.
## Risks / Limitations
- Remaining uncertainty, blocked actions, or routed next steps.Stop when the repository state is dirty, conflicted, diverged, missing required evidence, or ambiguous in a way that could overwrite user work, invalidate the requested scope, or require a gated action.
Require explicit action-specific confirmation for:
Broad approval such as "do whatever" is not enough for R4-R5 actions.
Load references/stash-safety.md when:
Load references/staged-boundaries.md when:
Load references/apply-vs-pop.md when:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.