repository-cleanup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repository-cleanup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Inspect local and remote branches, pull requests, commits, stashes, worktrees, and the local databases left behind by old worktrees. Recover valuable work, then remove the proven stale state the user selects, until the repository is current and organized. Nothing is removed that the user did not select by name.
Inspect local and remote branches, pull requests, commits, stashes, and worktrees. Recover valuable work, list everything stale, and remove only the items the user selects, until the repository is current and organized.Stop when valuable work is recovered and remaining repository state is intentional.
Use this when abandoned branches, old worktrees, unclear pull requests, unmerged commits, or forgotten stashes make it difficult to know which repository state still matters.
This loop cleans Git repository state. It is not a source-code housekeeping pass; use housekeeper for dead code, stale files, duplicated logic, broken links, unused dependencies, and project-structure cleanup.
git remote prune --dry-run <remote>); they are removal candidates like any other.pr-assets folders (see PR screenshots).cannot recover when nothing else holds a copy. Then ask the user to pick what to remove, in the shape of Selection Form below. An answer that names no item ("ok", "go ahead") picks nothing.Where AskUserQuestion is available, ask the step 7 selection in one call, one question (one tab) per kind of state, with up to 4 questions:
Tab (header) | Covers |
|---|---|
Branches | local branches, stale remote-tracking refs |
Worktrees | worktrees, with the databases that drop with them |
Stashes | stashes, orphaned databases |
Remote | remote branches, PRs to close, pr-assets folders |
Leave out a tab with no candidates. Every question is multiSelect: true, asks "Which <kind> should I remove?", and has 2–4 options with nothing pre-ticked:
git branch -d feat/login, fix/typo, … (all merged into main)".cannot recover item, an uncertain item, or a database with anything unlike it. Give it its own option, and say cannot recover in the description.Without the tool, show the same tabs as numbered lists in chat, and take the numbers the user answers with.
Use the repository's existing tools and hosting provider first. Common Git and GitHub CLI checks:
git status --short --branch
git stash list
git stash show --stat stash@{0}
git remote -v
git fetch --all --no-prune --no-prune-tags
git remote prune --dry-run origin
git worktree list --porcelain
git branch --format='%(refname:short) %(upstream:short) %(committerdate:relative)'
git branch --merged
git branch --no-merged
git log --all --decorate --oneline --graph --date-order -n 80
gh pr list --state open --json number,title,headRefName,baseRefName,author,updatedAt,url
gh pr list --state closed --limit 30 --json number,title,headRefName,baseRefName,author,updatedAt,closedAt,mergedAt,urlFetch with --no-prune --no-prune-tags even when the user's config sets fetch.prune or fetch.pruneTags: a pruning fetch deletes stale remote-tracking refs and local-only tags (an archive/* tag made to preserve work) that nobody selected. git remote prune --dry-run shows the stale refs as candidates instead.
Worktrees whose PR merged, and the databases left behind, come from one script. With no arguments it changes nothing and prints the candidates as JSON. It removes only the names you pass, after the user selected them, and it refuses the whole run, changing nothing, if one name is not a candidate:
bash scripts/prune-merged-worktrees.sh # list: merged clean worktrees, their databases, orphans
bash scripts/prune-merged-worktrees.sh --remove <worktree path> --drop pgsql:<database> # selected items onlyA worktree's database can be dropped only in the same run that removes that worktree. Never pass a name the user did not select, and never build the arguments from the whole list.
If gh is unavailable or the repository is not on GitHub, use the equivalent provider CLI, web UI, or local Git evidence and report the PR visibility gap.
Worktrees and one-off test runs leave local databases behind: a per-worktree DB_DATABASE, throwaway test databases (<app>_pr42, <app>_triage_<date>), and Laravel parallel testing's <db>_test_N copies of each. The script's databases list holds, with sizes, each candidate database by exact name, a parallel-testing copy as an item of its own. Its source says why: worktree (registered for, or named by, a candidate worktree), registry (a registered database whose worktree is gone), or orphan (named <app db>_* and named by no .env, .env.testing, or phpunit.xml of the main checkout or a remaining worktree). It never lists a database in use, or a parallel-testing copy of one.
Classify each listed database by its name: a PR number, branch, worktree, or date that maps to merged or removed work is abandoned; a name that reads as a deliberate copy (_backup, _snapshot, _pre_migration) or maps to nothing is uncertain. Show the list grouped that way, with sizes, in the step 7 selection, and drop only the selected names, through the script's --drop. Each drop is irreversible: offer a pg_dump/mysqldump first for anything uncertain.
The pr skill uploads PR screenshots to the orphan pr-assets branch, one folder per PR branch, and nothing else ever removes them: every clone downloads the whole branch. One script lists the folders whose PR merged or closed more than 90 days ago (--days N to change it), or, with no PR found, whose last upload is that old. An open PR's folder is never a candidate. With no arguments it changes nothing:
bash scripts/prune-pr-assets.sh # plan: tip, candidates, kept, with sizes
bash scripts/prune-pr-assets.sh --tip <plan tip> --drop <folder>... # selected folders onlyOffer the candidates as one Remote option, with their count, total size and folder names, and cannot recover in its description: dropping rewrites pr-assets as a fresh orphan commit with a force push, leased on the plan's tip, so those images leave every future clone. A kept folder's …/blob/pr-assets/… links keep working; links pinned to a commit (…/blob/<sha>/…, from older uploads) point at unreachable commits that GitHub may stop serving once it garbage-collects them. A tip that moved since the plan refuses the run; list again.
Uncertain items are not cleanup candidates until more evidence or user approval resolves them.
git branch -d for selected local branches proven merged. Use git branch -D only after explicit approval and only after preserving any useful commits.git rev-parse -q --verify refs/tags/<tag>) before deleting the branch it preserves.End with:
Start each item that needs the user (a risk, a deferral, an approval) with ⚠️, and each failed check with ❌. No other marks.
git reset --hard, git checkout --, git clean, or force-delete branches unless the user explicitly asked for that exact destructive action.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.