git-push-secondary-merge-primary — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited git-push-secondary-merge-primary (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Execute the standard two-branch handoff: finish work on the secondary branch, push it, merge it into the primary branch, push the primary branch, then return to the secondary branch.
Use "secondary branch" for the branch that contains the current work, such as dev, develop, or another integration branch. Use "primary branch" for the protected/release branch, such as main or master.
This workflow is for safe release-sync handoffs where both branches need to be pushed and the primary branch should preserve a clear merge result.
Use this skill when the user asks for:
dev → main or develop → masterDo not use this skill for:
git-weekly-report instead)code-reviewer or frontend-code-review instead)Follow the branch detection rules first, then execute the workflow in order. Stop and report the blocker instead of guessing when branch names, merge conflicts, dirty worktrees, or rejected pushes cannot be handled safely.
dev or main but the repository uses develop or master, inspect actual branches before choosing.git symbolic-ref refs/remotes/origin/HEAD when available.main, then master.dev, then develop.git status --short, git branch --show-current, and git remote -v.<secondary_branch> and <primary_branch> using the branch detection rules.<secondary_branch>.<secondary_branch>, continue.git checkout <secondary_branch> and git pull --ff-only origin <secondary_branch>.<secondary_branch> if there are local changes.git add unless the user requested a narrower scope.type(scope): prefix and a Chinese summary after the colon.--no-verify.<secondary_branch> has no local changes, skip commit and continue to push.<secondary_branch>.git push origin <secondary_branch>.<primary_branch>.git checkout <primary_branch>.git pull --ff-only origin <primary_branch>.git merge --no-ff <secondary_branch> -m "chore(<primary_branch>): merge <secondary_branch> into <primary_branch>" to preserve a merge commit when <primary_branch> does not already contain <secondary_branch>.<primary_branch>.git push origin <primary_branch>.<secondary_branch>.git checkout <secondary_branch>.git status --short and git branch --show-current.<secondary_branch>.Keep the final response concise. Include successful branch pushes and commit hashes. If the host app supports Git directives, emit them only after the matching Git action succeeds.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.