commit-push-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-push-sync (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run when the user asks to commit and push. The flow is: refresh what the change made stale (local docs, then linked Obsidian notes), do the git work with a clean Conventional Commit, optionally tag, then — GitHub only — sync public metadata and cut a Release.
Keep it lightweight. This is a push, not a repo audit.
Local docs live in the repo, so this applies to every remote (GitHub, GitLab, a private server, or no remote at all).
(structure, conventions, workflows)?
Update only what is genuinely out of date, and stage it alongside the code so it lands in the same commit. Don't create docs the repo doesn't already have.
Some projects keep their real documentation in an Obsidian vault rather than in the repo. Two separate questions, in order: is Obsidian in play at all, and can you reach the notes.
Any one of these is enough — check cheaply, and only once:
obsidian-cli, obsidian-markdownfrom kepano/obsidian-skills) — its presence means the user works with a vault, even if the CLI itself is not installed;
PATH (command -v obsidian);.obsidian/ directory inside or beside the repo, or a vaultpath configured in CLAUDE.md / .env / project config.
If none of these hold, do nothing and move on. This is the common case and is not a failure. Never install the CLI, start Obsidian, or create a vault.
Do not gate on the CLI. Take the highest rung of this ladder that works:
obsidian search query="<repo name>" limit=10 # which notes cover this project
obsidian read file="<Note>" # read before editing
obsidian backlinks file="<Note>" # how it fits the vault's structurevault path but the CLI is unavailable (Obsidian not installed, or not running), read and write the .md files directly with your normal file tools. Grep for the repo name to find the relevant notes. Obsidian picks up external edits on its own.
If an Obsidian skill is available, follow it for syntax — wikilinks, embeds, callouts, properties. It is the authority on Obsidian Flavored Markdown; don't improvise a format this skill doesn't specify.
If you can detect a vault but genuinely cannot reach it by any rung (no CLI, no MCP, no known path), say so in one line and continue with the push. Don't guess at paths.
Ask — once, in passing — whether the user wants to start tracking this project in their vault. Keep it to one line alongside your other output; it is an offer, not a blocker.
single note following the conventions of its neighbours, then continue.
never hold up the git work waiting on this, and don't ask again in the same session.
Judge whether the change you are committing makes the notes stale — a renamed command, a new feature, a changed setup step, a decision that supersedes what the note records. Follow the vault's existing conventions (folder placement, properties, wikilinks, tags); mirror what neighbouring notes do rather than inventing a format.
Notes are the user's own knowledge base, so propose the edit and get confirmation before writing. Then apply it — via the CLI when you have it:
obsidian append file="<Note>" content="..." silent
obsidian property:set name="updated" value="<YYYY-MM-DD>" file="<Note>"— or by editing the note file directly when you don't.
Prefer appending to or editing an existing note over creating a new one, and only create one when the user asks. Vault edits are not part of the commit — mention them separately when you report. If both a repo doc and a vault note cover the same thing, update the repo doc and leave the note pointing at it rather than duplicating.
Borrowed from changelogen's philosophy: the commit history is the source of truth. Every everyday commit should be written well enough that a changelog could later be generated from git history alone. You are not generating a changelog here — just making the messages clean enough that any tool could.
Stage the intended changes (plus doc updates from step 1) and write the message in Conventional Commits form:
type(scope): subjectfeat, fix, docs, refactor, perf, test, build,ci, chore, style.
feat(auth): ….! after the type/scope (feat!:) and/or add aBREAKING CHANGE: footer explaining the break.
separate well-typed commits — mixed commits are what make changelogs messy later.
user's branching norms (branch first if on the default branch and that's the norm).
Stay release-aware (informational only — do NOT act): note in one line the semver impact the commit implies, per ${CLAUDE_PLUGIN_ROOT}/references/versioning.md, so the user knows where history is heading. Do not bump the version or write a CHANGELOG.md — those belong to changelog-release.
Then push.
Tagging is off by default — a routine commit+push never creates a tag. Only attach one when the user explicitly asks ("tag this push", "commit and push with a tag").
Read ${CLAUDE_PLUGIN_ROOT}/references/versioning.md and compute the next version from it — that file is the single source of truth for the tag format, the bump table, and the mandatory 0.x rule. Propose the version, get confirmation, then create an annotated tag on the commit you just made and push it with the branch:
git tag -a v1.5.0 -m "v1.5.0"
git push --follow-tags # pushes the branch and any annotated tags it reachesRemember that a tag was pushed — it is the trigger for the Release step below.
This skill creates only the git tag (and the GitHub Release). It does not touch package.json or CHANGELOG.md; route the user to changelog-release for that.
gh?Everything below is GitHub-only. Many projects are not on GitHub — then there is simply nothing to do: report the push (and the tag, if any) and stop. That is the normal outcome, not a failure; the tag still reached the remote either way.
git remote -v # is there a GitHub remote at all?
gh --version # is gh installed?
gh auth status # is it authenticated?If the remote isn't GitHub, or gh is missing/unauthenticated, stop here. Do not install or authenticate gh yourself.
Only when both are true: the push attached a tag, and this is GitHub with a usable gh. A push without a tag never creates a release — skip to step 7.
A Release is outward-facing, so confirm the tag name, title, and prerelease status first. Check gh release view <tag> — if a release already exists, report it rather than duplicating.
gh release create v1.5.0 --title "v1.5.0" --generate-notes
# or supply notes distilled from the Conventional Commits in range:
# --notes "..."
# add --prerelease for -rc/-beta tags, or --draft to stage without publishingReport the release URL (gh release view v1.5.0 --json url).
gh repo view --json name,description,repositoryTopics,homepageUrlCompare against what the project now actually is (README, manifest, what you just pushed):
replacement only if it is genuinely stale or wrong.
churn by removing existing ones.
If everything is accurate, say so and change nothing.
Description and topics are outward-facing. Confirm wording first (offer concrete options rather than picking silently). Topic additions are low-risk — you may apply and report — but never remove a topic without asking.
gh repo edit <owner>/<repo> --description "..." --add-topic <topic>
# --remove-topic <topic> # only when clearly justified and confirmedVerify and report the final description + topic list.
It is never a reason to push — don't push solely to trigger a sync.
references/versioning.md. If you findyourself reciting a bump table from memory, read the file instead.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.