Skip to content
skillsafebeta
← Report library
Purpose / Development

Resolving Merge Conflicts Skill Security Audit

What the author says it does (original text)

Use when you need to resolve an in-progress git merge/rebase conflict.

Independent security check

Do not install or run it yet

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
High risk

“Stage everything” can commit unrelated changes or sensitive files

Source references: 1
What we found

The instruction does not limit staging to reviewed conflict-resolution files; it directs the agent to stage everything and commit. Pre-existing edits, generated files, or files containing credentials could therefore enter the commit.

Why this matters

The user can lose control of the commit boundary. Unrelated code or secrets may become part of Git history and be exposed to repository readers if the commit is later pushed.

This is an active instruction, not an example or warning. After resolving conflicts, the Skill says to “Stage everything and commit” without limiting staging to conflict-related files. If the worktree already contains unrelated edits, generated files, or accidentally placed sensitive files, they could be included in the commit. A user can require staging only reviewed conflict files and approval of the staged file list and diff before committing.

SKILL.md:14In the instructionsOpen original file
5. **Finish the merge/rebase.** Stage everything and commit. If rebasing, continue the rebase process until all commits are rebased.
Medium risk

The mandatory “never abort” rule can cement a wrong resolution when intent is unclear

Source references: 2
What we found

The Skill explicitly forbids aborting and tells the agent to choose the side matching the perceived merge goal when changes are incompatible. If commits, PRs, or tickets do not establish user intent, the agent is still directed to proceed.

Why this matters

Behavior from the wrong side may be written into files and committed. During a rebase, that decision may also affect multiple replayed commits, making review and recovery harder.

The Skill first calls for examining commits, PRs, and issues, but then explicitly requires always resolving and never aborting, with the agent choosing whichever side it believes matches the merge goal. If those sources are missing, ambiguous, or contradictory, the workflow does not require pausing for the user's decision; the selected resolution is then staged and committed. A user can require confirmation whenever intent cannot be established reliably and review before commit.

SKILL.md:8In the instructionsOpen original file
2. **Find the primary sources** for each conflict. Understand deeply why each change was made, and what the original intent was. Read the commit messages, check the PRs, check original issues/tickets.3. **Resolve each hunk.** Preserve both intents where possible. Where incompatible, pick the one matching the merge's stated goal and note the trade-off. Do **not** invent new behaviour. Always resolve; never `--abort`.
Show 1 other places
SKILL.md:14In the instructionsOpen original file
5. **Finish the merge/rebase.** Stage everything and commit. If rebasing, continue the rebase process until all commits are rebased.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

0 instruction sections

The Skill’s workflow examines the current merge or rebase and asks the agent to use commit history, PRs, and original tickets to understand both sides of each conflict.

View source
SKILL.md:6In the instructionsOpen original file
1. **See the current state** of the merge/rebase. Check git history, and the conflicting files.2. **Find the primary sources** for each conflict. Understand deeply why each change was made, and what the original intent was. Read the commit messages, check the PRs, check original issues/tickets.

After resolving conflicts, the Skill discovers and runs project checks, fixes merge-related failures, and then completes the merge or continues the rebase.

View source
SKILL.md:12In the instructionsOpen original file
4. Discover the project's **automated checks** and run them, typically typecheck, then tests, then format. Fix anything the merge broke.5. **Finish the merge/rebase.** Stage everything and commit. If rebasing, continue the rebase process until all commits are rebased.
Start here · InstructionsSKILL.md
resolving-merge-conflicts

The instructions have no section headings. Supporting files and code excerpts are available below.

Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
19
File checksum (to compare versions)
710a87cffde5b967da6d319e815499ce0e1e686b95dedf47d8db6468be7b3043