skills.rest
paulnsorensen
paulnsorensenCOMMUNITY
Explore all skills by this author →
GitHub

git-hygiene

Prevent unsafe git commands that read file contents from arbitrary refs.

2|Updated Sep 12, 2016
Search Tags:#git#security#bash#hygiene#guardrails#version-control#read-tool
One-click install
npx skills add https://github.com/paulnsorensen/dotfiles --skill git-hygiene-paulnsorensen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: git-hygiene
Source: https://github.com/paulnsorensen/dotfiles/tree/main/claude/skills/git-hygiene
Command: npx skills add https://github.com/paulnsorensen/dotfiles --skill git-hygiene-paulnsorensen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Git has commands that can read arbitrary file contents from any branch or commit. Using them in scripts or automation can bypass file access controls and leak sensitive data. This skill explains why these patterns are dangerous and how to avoid them.

Core Features & Use Cases

  • Block unsafe patterns like git show <ref>:<path> and git cat-file -p <ref>:<path>.
  • Provide safe alternatives using the Read tool, diffs, or isolated worktrees.
  • Use case: during scripting, CI, or code review, prevent leaking contents from other refs.

Quick Start

Switch to a safe worktree and read the target file with the Read tool instead of using git show ref:path.

Frequently Asked Questions about git-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Why is using git show with a branch ref and colon syntax unsafe for reading files?▼

Using git show ref:path is unsafe because it can read arbitrary file contents from any branch or commit, bypassing file access controls and potentially leaking sensitive data in scripts or CI automation.

How do I safely read file contents from another git branch without leaking data?▼

To safely read files from another branch, switch to an isolated worktree and use the Read tool instead of unsafe commands like git show ref:path or git cat-file -p ref:path.

What is the best way to prevent accidental sensitive file reads in git automation workflows?▼

The best way to prevent accidental sensitive reads in git automation is to apply guardrails that block raw file reads from arbitrary refs, guiding scripts to use diffs or the Read tool instead.

Can I use git cat-file to read file contents from arbitrary commits in CI pipelines?▼

You should not use git cat-file -p ref:path in CI pipelines because it bypasses file access controls and risks leaking sensitive data from other commits.

When do I need guardrails for git read operations during code review?▼

You need git read guardrails during code review and automation workflows when operations reference other branches or commits using colon syntax, preventing unsafe raw file content extraction.

Does this approach affect normal git diff workflows for reviewing changes?▼

No, this approach encourages using git diffs to review changes safely. It only discourages unsafe raw file reads via git show ref:path and git cat-file -p ref:path, redirecting to safe Read tool patterns.

Related Skills

Explore More Software Engineering Skills→
HexAI-incHexAI-inc

git-worktrees

Create isolated Git worktrees for feature development across Windows and Unix-like systems.

Official
Advanced
XeXe
730

safe-file-reader

Read file contents and search patterns with grep and glob.

Community
Basic
Soham407Soham407
1

git-guardrails-claude-code

Block destructive git commands in Claude Code via PreToolUse hooks.

Community
Basic
ZurybrZurybr

sanitize-git-repo

Detect and remove sensitive credentials from Git repositories and their commit history using pattern, file-based and entropy methods.

Community
Advanced