repo-rename — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited repo-rename (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
If a slash or dollar invocation already added these instructions to the conversation, follow them directly. In that case, do not invoke this skill again through a skill tool.
Preview the complete GitHub, Git, filesystem, and agent-continuity mutation set before applying a repository rename.
origin URL.origin. Both paths must have the same folder name. Preview missing parent directories before creating them.
content. The helper then skips the GitHub rename and the origin update. A repository with any remote still requires a valid GitHub context.
~/.claude/projects, ~/claude/projects when present, ~/.codex/sessions, and ~/.codex/config.toml. This continuity update does not apply to repos with no active transcripts.
virtual environments), caches, and generated build directories.
PROMPT.md, TODO.md, and symlinks before reading replacementcandidates. Prune excluded directories during discovery. When the user explicitly authorizes updating notes, dependencies, caches, or generated files, pass --include-local-state to both preview and apply. This includes those repository text files while preserving file permissions. Symlinks, binary files, and .git remain excluded.
CLAUDE_CONFIG_DIR and CODEX_HOME, gates continuity updates on active transcripts, and replacesonly the absolute repository path in continuity stores and Codex config.
whether it has any active AI chat transcript before treating continuity preservation as in scope:
${CLAUDE_CONFIG_DIR:-~/.claude}/projects/<encoded-repo-path> (the absolute repo path withevery non-alphanumeric character replaced by -) and check it exists and is non-empty.
${CODEX_HOME:-~/.codex}/sessions and check whether any session file references the exact absoluterepo path.
proceed for the GitHub, git, filesystem, and repository-content changes below.
uv run <skill-dir>/scripts/repo-rename.py <new-name> --dry-runFor a same-name move, run from any directory:
uv run <skill-dir>/scripts/repo-rename.py <source-path> <destination-path> --dry-runThe helper requires a clean worktree, matching GitHub repo/folder names, a free target path, and valid GitHub context. For a repository with no remotes, it requires only a clean worktree and a free target path. It reports "local_only": true and a local:<old>-><new> confirmation token. It prints the old/new repo and paths, exact confirmation token, external commands, directory moves, every replacement file, occurrence counts, and rollback coverage. Same-name moves use move:<absolute-source>-><absolute-destination> tokens. Linked worktrees and external Git directories are unsupported.
--dry-run was requested, return the preview and stop. A successful dry run must not change the GitHub repo,remote, folder, config, transcripts, or repository files.
the confirmation authorizes the GitHub rename, local folder move, Claude project-folder move when enabled, origin update, and every listed continuity/repository replacement. For a local-only preview, state that no GitHub or origin change occurs. Lead with ### ⚠️ Rename preview — no changes made. Show GitHub, folder, origin, replacement counts, and rollback coverage in compact tables, then the exhaustive file/count list. Put the exact confirmation token alone in code formatting. If any preview fact changes, regenerate it and ask again.
For same-name moves, show the unchanged GitHub identity and origin, plus each parent directory to create.
uv run <skill-dir>/scripts/repo-rename.py <new-name> --apply --confirm '<owner/old->owner/new>'For a same-name move, pass both paths and the preview's move: token instead.
The helper re-runs preflight, backs up every replacement file, applies deterministic literal replacements, and attempts rollback on failure. Never bypass its clean-tree, target-path, or confirmation checks.
gh repo view, git remote get-url origin, pwd -P, and a search for remaining oldabsolute-path/name references in the listed scope. Report intentional remaining matches separately.
Dry-run completion is a full mutation preview with zero writes. Apply completion requires the new GitHub identity, folder, remote, and listed continuity references to agree, plus a clean verification report. If rollback is incomplete, stop and lead with ### ⛔ Rollback incomplete, then report every failed rollback action before doing anything else. On success, use ### ✅ Repository renamed and a surface/expected/verified table. Keep helper JSON, confirmation tokens, commands, paths, URLs, and rollback errors exact and undecorated.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.