git-hygiene

Prevent unsafe git commands that read file contents from arbitrary refs.

2|Updated Sep 12, 2016

Search Tags:#git #security #bash #hygiene #guardrails #version-control #read-tool

Ready to run

npx skills add https://github.com/paulnsorensen/dotfiles --skill git-hygiene-paulnsorensen

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: git-hygiene
Source: https://github.com/paulnsorensen/dotfiles/tree/main/claude/skills/git-hygiene
Command: npx skills add https://github.com/paulnsorensen/dotfiles --skill git-hygiene-paulnsorensen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Git has commands that can read arbitrary file contents from any branch or commit. Using them in scripts or automation can bypass file access controls and leak sensitive data. This skill explains why these patterns are dangerous and how to avoid them.

Core Features & Use Cases

Block unsafe patterns like git show <ref>:<path> and git cat-file -p <ref>:<path>.
Provide safe alternatives using the Read tool, diffs, or isolated worktrees.
Use case: during scripting, CI, or code review, prevent leaking contents from other refs.

Quick Start

Switch to a safe worktree and read the target file with the Read tool instead of using git show ref:path.

Frequently Asked Questions about git-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why is using git show with a branch ref and colon syntax unsafe for reading files?▼

Using git show ref:path is unsafe because it can read arbitrary file contents from any branch or commit, bypassing file access controls and potentially leaking sensitive data in scripts or CI automation.

How do I safely read file contents from another git branch without leaking data?▼

To safely read files from another branch, switch to an isolated worktree and use the Read tool instead of unsafe commands like git show ref:path or git cat-file -p ref:path.

What is the best way to prevent accidental sensitive file reads in git automation workflows?▼

The best way to prevent accidental sensitive reads in git automation is to apply guardrails that block raw file reads from arbitrary refs, guiding scripts to use diffs or the Read tool instead.

Can I use git cat-file to read file contents from arbitrary commits in CI pipelines?▼

You should not use git cat-file -p ref:path in CI pipelines because it bypasses file access controls and risks leaking sensitive data from other commits.

When do I need guardrails for git read operations during code review?▼

You need git read guardrails during code review and automation workflows when operations reference other branches or commits using colon syntax, preventing unsafe raw file content extraction.

Does this approach affect normal git diff workflows for reviewing changes?▼

No, this approach encourages using git diffs to review changes safely. It only discourages unsafe raw file reads via git show ref:path and git cat-file -p ref:path, redirecting to safe Read tool patterns.