中风险
探索并汇报 Git 远程配置时可能暴露嵌入 URL 的凭据
原文依据：2 处发现了什么
Skill 明确要求读取 `git remote -v` 和 `.git/config`，随后总结发现。旧仓库或自动化环境有时会把访问令牌、用户名或密码嵌入远程 URL；这里没有要求在展示前清除 URL 的 userinfo、令牌或查询参数。
为什么需要注意
如果代理原样展示远程地址，凭据可能进入聊天记录、日志或后续模型上下文，使他人能够访问相应代码托管账户或仓库。
该 Skill 会检查 `git remote -v` 和 `.git/config`，之后向用户总结发现。如果远程 URL 内嵌用户名、密码、访问令牌或敏感查询参数，而代理直接展示原始值，凭据可能进入对话或日志。源码没有要求隐藏这些字段。用户可要求作者只报告托管平台和仓库名，并在展示前移除 URL 的 userinfo、令牌和查询参数。
Look at the current repo to understand its starting state. Read whatever exists; don't assume:- `git remote -v` and `.git/config`: is this a GitHub repo? Which one?- `AGENTS.md` and `CLAUDE.md` at the repo root: does either exist? Is there already an `## Agent skills` section in either?- `CONTEXT.md` and `CONTEXT-MAP.md` at the repo root- `docs/adr/` and any `src/*/docs/adr/` directories- `docs/agents/`: does this skill's prior output already exist?- `.scratch/`: a sign that a local-markdown issue tracker convention is already in use- Is the `triage` skill installed? (a `triage` skill folder alongside this one, or `triage` in your available skills.) This decides whether Section B runs at all.- Monorepo signals: a `pnpm-workspace.yaml`, a `workspaces` field in `package.json`, or a populated `packages/*` with its own `src/`. These are present only in a genuinely large multi-package repo; their absence means single-context, which is almost every repo.查看另外 1 个位置
### 2. Present findings and askSummarise what's present and what's missing. Then take the sections in order. One section, one answer, then the next.Lead each section with the recommended answer so the user can accept it in a word. Give a one-line explainer only when the choice genuinely branches; skip the section entirely when exploration already settled it (Section B when `triage` isn't installed, Section C when there's no monorepo).