sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sync (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps bin/sync.sh. Rebases (or merges) the current feature branch onto its base, after a clean-tree + branch-safety check.
a clear message; suggest switching to a feature branch first (/nyann:branch creates one).
dirty in JSON) → stop and tell theuser to commit or stash first. Don't silently stash on their behalf — git stash is a footgun when the rebase also conflicts.
Default to rebase. Use merge when:
gitflow and the target baseis develop/main (shared long-lived branches — some teams ban rebase on these).
PRs (rebasing rewrites history; merges don't).
If unclear, you MUST call the `AskUserQuestion` tool (not plain text):
{
"questions": [
{
"question": "How should upstream changes be integrated?",
"header": "Strategy",
"multiSelect": false,
"options": [
{ "label": "Rebase (Recommended)", "description": "Keeps history linear; replays your commits on top of base" },
{ "label": "Merge", "description": "Preserves original commits; adds a merge commit" }
]
}
]
}bin/sync.sh picks base via: --base > @{upstream} > origin/HEAD
main. Override only when the user explicitly names a differenttarget ("sync against develop"). Normally trust the resolution.
bin/sync.sh --target <cwd> [--strategy rebase|merge] [--base <branch>] [--dry-run]--dry-run reports what would happen without mutating. Use it when the user is cautious or you want to show them the ahead/behind count first.
| status | meaning | what to tell the user |
|---|---|---|
up-to-date | behind == 0 | "Already up to date with <base>." No action needed. |
synced | operation completed | "Synced via <strategy>. Now <ahead> ahead, 0 behind." |
dirty | working tree had uncommitted changes | "Working tree has uncommitted changes. Commit or stash first." |
skipped | base not found locally or on origin | "Couldn't find <base> locally or on origin. Check the branch name." |
conflicts | rebase/merge halted mid-operation | See §6 — this is the tricky case. |
The script stops and leaves the working tree in a rebase-in-progress or merge-in-progress state. Do NOT call sync again — the script doesn't know how to resume.
Read the conflicts[] array from the JSON. For each file, offer to help resolve it (read the file, show conflict markers, ask the user which side to keep). When the user is done:
git add <resolved-files> then git rebase --continue.git add <resolved-files> thengit -c user.email=... -c user.name=... commit --no-edit to finalize.
If the user wants to bail: git rebase --abort or git merge --abort. Either returns the working tree to its pre-sync state.
pr skill.git rebase --abort/ git merge --abort yourself and confirm.
&& git pull` handles that.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.