branch-rebase — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited branch-rebase (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Rebase the current feature branch onto its upstream target with automatic resolution of trivial conflicts.
/rebase-branch [target]target — branch to rebase onto. Defaults to the first of baseline, main, master that exists.Follow every step in order. Do not skip steps. Do not push at the end.
git rev-parse --is-inside-work-treeIf not a git repo, stop and tell the user.
CURRENT=$(git branch --show-current)If CURRENT is empty (detached HEAD), stop: "You are in detached HEAD state. Check out a branch first."
If a target argument was provided, use it. Otherwise detect the target:
for candidate in baseline main master; do
if git show-ref --verify --quiet "refs/heads/$candidate" || \
git show-ref --verify --quiet "refs/remotes/origin/$candidate"; then
TARGET=$candidate
break
fi
doneIf no target found, stop: "Could not find baseline, main, or master. Specify a target branch."
If CURRENT equals TARGET, stop: "You are already on the target branch."
git status --porcelainIf output is non-empty, stop immediately and tell the user:
You have uncommitted changes. Please commit or stash them before rebasing.
List the dirty files so they can decide. Do not proceed.
git checkout $TARGET
git pull --ff-onlyIf the pull fails (e.g. diverged local target), warn the user and ask whether to continue or abort.
git checkout $CURRENT
git rebase $TARGETIf the rebase completes cleanly, skip to step 7.
When the rebase stops with conflicts, inspect each conflicted file:
git diff --name-only --diff-filter=UFor each conflicted file, classify and act:
#### Auto-resolvable (resolve silently, then git add the file)
| Pattern | Resolution |
|---|---|
build.gradle / build.gradle.kts — only version = "..." lines conflict | Accept the current branch's version (ours during rebase = theirs flag). The developer's version bump is intentional. |
pom.xml — only <version> inside the project's own <parent> or root <project> block conflicts | Same — keep the current branch's version. |
package.json — only the top-level "version" field conflicts | Keep current branch's version. |
CHANGELOG.md / CHANGES.md / HISTORY.md — conflict is between different version headings (e.g. target added ## 1.3.0 and current branch has ## 1.4.0) | Keep both version sections, ordered newest-first. Each version heading and its entries stay intact. |
Changelog same-version conflicts: If both sides modified entries under the same version heading, this is not auto-resolvable. Two branches must not share a version — treat this as a complex conflict. | *.csproj — only <Version> or <PackageVersion> conflicts | Keep current branch's version. |
After auto-resolving a file:
git add <file>#### Not auto-resolvable
Any conflict that does not match the table above is complex. Use the /branch-resolve-conflicts skill:
/branch-resolve-conflictsThis skill will:
If the user prefers to abort rather than resolve complex conflicts:
git rebase --abortStop and report that the rebase was aborted.
After all conflicts for the current commit are resolved:
git rebase --continueIf further commits also conflict, repeat step 6.
After the rebase completes, automatically ensure the branch has a unique version and changelog section.
#### 7a. Detect version state
Read the version from the build manifest on both branches:
TARGET_VERSION=$(git show $TARGET:build.gradle 2>/dev/null | grep -oP "version\s*=\s*['\"]?\K[^'\"]+")
CURRENT_VERSION=$(grep -oP "version\s*=\s*['\"]?\K[^'\"']+" build.gradle 2>/dev/null)Also check build.gradle.kts, pom.xml, package.json, or *.csproj using the same approach — whichever manifest exists.
#### 7b. Bump version if needed
If CURRENT_VERSION equals TARGET_VERSION (the rebase collapsed the version), bump it automatically:
1.3.0 → 1.3.1).Auto-bumped version from{TARGET_VERSION}to{NEW_VERSION}inbuild.gradle.
If the version format is non-standard or you cannot parse it reliably, ask the user what version to use instead.
#### 7c. Ensure a unique changelog section
Read the changelog file (CHANGELOG.md, CHANGES.md, or HISTORY.md — whichever exists).
NEW_VERSION (from 7b) or CURRENT_VERSION (if already unique) does not exist, create one at the top of the changelog: ## {VERSION}
- Rebased onto `{TARGET}`.The user will fill in real entries, but the section must exist so it doesn't collide with the target's entries.
- Rebased onto `{TARGET}`.#### 7d. Commit the fixup
If any changes were made in 7b or 7c:
git add build.gradle CHANGELOG.md # (or whichever files were touched)
git commit -m "chore: bump version to {NEW_VERSION} after rebase onto {TARGET}"This keeps the version/changelog fixup as a clean, separate commit at the tip of the branch.
Tell the user:
Rebase complete.{CURRENT}is now based on{TARGET}.
If a version bump or changelog update was made, list exactly what changed:
- Version bumped:{OLD}→{NEW}inbuild.gradle- New changelog section added for{NEW}
Then:
Your branch has not been pushed. When you're ready: `` git push --force-with-lease ``List any files that were auto-resolved during conflict resolution so the user can verify.
--force-with-lease in the final message.git rebase --abort over leaving the repo in a broken state.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.