etanhey/git-guardian
skills/golem-powers/git-guardian/SKILL.md
Safety gate for destructive git operations. Invoke before force-push, reset --hard, branch -D/delete, checkout ., restore ., clean -f, or any commit/push while on main/master. NOT for: normal git add, commit on feature branches, log, diff, status, stash.
$ install --global
skillsauthnpx skillsauth add etanhey/golems git-guardianInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 1, 2026, 3:17 AM131.7s2 files scanned
SKILL.md
- name:
- git-guardian
- description:
- Safety gate for destructive git operations. Invoke before force-push, reset --hard, branch -D/delete, checkout ., restore ., clean -f, or any commit/push while on main/master. NOT for: normal git add, commit on feature branches, log, diff, status, stash.
Git Guardian
Prevents git footguns by checking blast radius, uncommitted state, and branch safety before any destructive operation.
Trigger Operations
Invoke this skill when about to run ANY of these:
| Operation | Risk |
|-----------|------|
| git push --force / git push -f | Overwrites upstream history |
| git reset --hard | Destroys local changes permanently |
| git branch -D / git branch -d | May lose unmerged commits |
| git checkout . / git restore . | Destroys uncommitted local changes |
| git clean -f / git clean -fd | Permanently deletes untracked files |
| git rebase on a shared branch | Rewrites shared history |
| Commit or push while on main/master | Pollutes main branch history |
| --no-verify on any command | Bypasses safety hooks |
Protocol
For every destructive operation, run these checks in order:
1. Branch Safety Check
git branch --show-current
- If on
mainormaster: STOP. Do not proceed with force-push, reset --hard, or unprotected commits. Redirect to a feature branch. - Exception:
git pull --rebaseandgit mergeare safe on main.
2. Uncommitted Changes Check
git status --short
git stash list
- List any modified, staged, or untracked files that would be destroyed.
- If there are uncommitted changes: name them explicitly before asking for confirmation.
- Never silently proceed past uncommitted changes.
3. Impact Summary
Before executing, show:
⚠️ Git Guardian — [OPERATION] on [BRANCH]
Commits to be lost: [N commits, with short hashes + messages]
Files to be lost: [list of modified/untracked files]
Branch status: [merged | UNMERGED — N commits only here]
Upstream: [N commits ahead/behind origin/branch]
Proceed? [y/N]
Only proceed after explicit user confirmation — or if user explicitly says "yes, proceed", "force it", "I know".
4. Specific Rules by Operation
Force Push (--force / -f)
- Check current branch — block if
main/masterunconditionally. - Run
git log origin/<branch>..HEAD --onelineto show what will be overwritten. - Show confirmation summary. Proceed only after user confirms.
- Never suggest
--force-with-leaseas a workaround to silently bypass this check.
Reset Hard (reset --hard)
- Run
git log HEAD~<N>..HEAD --onelineto list commits being dropped. - Run
git status --shortto show uncommitted work that will be lost. - If uncommitted changes exist: explicitly list each file. Ask for confirmation.
- Proceed only after explicit confirmation.
Branch Delete (-D / -d)
- Run
git branch --mergedto check if the branch is merged. - If not merged: list the N commits that exist only on this branch.
- Warn: "These commits are not in any other branch. Deleting will make them unrecoverable without
git reflog." - Ask for explicit confirmation.
Checkout/Restore (. or path)
- List the files that will be reverted.
- Show which files have staged changes that would also be dropped.
- Ask for confirmation.
Clean (-f)
- Run
git clean -n(dry run) to list files that would be deleted. - Flag any
.env*or secret-looking files prominently. - Ask for explicit confirmation. Never auto-clean.
Commit/Push on main/master
- Detect current branch =
mainormaster. - Suggest: "Create a feature branch first:
git checkout -b feat/<name>" - Do NOT commit or push. Redirect the user.
--no-verify
- Never run any git command with
--no-verify. - Instead: investigate why the hook is failing and fix the root cause.
- If user insists, surface this as a hard stop: "The hook failure is protecting you. What does the error say?"
Non-Negotiables
- NEVER force-push to
main/masterunder any circumstances. - NEVER use
--no-verifyto bypass hooks. - NEVER silently proceed past uncommitted changes.
- NEVER delete an unmerged branch without explicit confirmation.
- If user overrides a warning ("I know, just do it"), proceed — but log what was overridden.
Integration
/pr-loopstep 5 — git-guardian's branch check is a prerequisite to commit; pr-loop handles CodeRabbit review./pr-loop— calls git-guardian before any force-push during rebase/fixup cycle.- Native
git worktree— worktrees always operate on non-main branches; git-guardian still applies for reset/clean inside worktrees.
Related Skills
etanhey/writing-skills
development
VerifiedTrustedCommunity
Create, edit, and verify golem-powers skills using the standard SKILL.md structure, workflow files, adapters, templates, and eval fixtures. Use for new skills, structural edits, workflows/adapters, and pre-deploy validation. NOT for invoking existing skills, superpowers skills, or skill-creator agent workflows.
3SKILL.mdUpdated Jun 4, 2026
etanhey/video-extract
testing
VerifiedTrustedCommunity
Extract structured knowledge from any video source — YouTube URLs or local screen recordings. YouTube → gems workflow (yt-dlp transcript → keyword hotspots → frame extract → brain_digest → structured gems). Screen recordings → QA workflow (reuses /qa-video stalker pipeline). Use when user shares a YouTube link wanting deep extraction with frames, shares a .mov/.mp4 for QA processing, says "extract from video", "video gems", "process this recording", or mentions gem extraction from video content.
3SKILL.mdUpdated Jun 4, 2026
etanhey/monitor-loop
testing
VerifiedTrustedCommunity
Use when running or reviewing any recurring monitor loop for merge queues, worker queues, collab tails, or agent completion. Enforces drive-to-completion ticks: every tick must query live state with `!`, classify whether real progress happened, and then dispatch, verify-and-decrement, or escalate-park. Triggers on: monitor loop, /loop, recurring tick, keep monitoring, silent autonomous, merge gate, blocked review, no-progress loop.
3SKILL.mdUpdated Jun 4, 2026
etanhey/mehayom
tools
VerifiedTrustedCommunity
MeHayom freelance client management — daily updates, decision tracking, time logging. Use when drafting Yuval updates, logging scope changes, tracking hours, or any MeHayom client communication. Triggers: 'draft Yuval update', 'client update', 'daily update', 'log decision', 'track time', 'mehayom'.
3SKILL.mdUpdated Jun 4, 2026