Install
$ agentstack add skill-cboone-agent-harness-plugins-use-git ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Use Git
Conventions for running git and GitHub CLI (gh) commands in Claude Code. These rules keep Bash commands short, avoid unnecessary permission prompts, and prevent destructive operations.
Core Principles
- Tmpfiles for long content: Write long strings (PR bodies, issue bodies, review replies) to a tmpfile via the Write tool, then pass
--body-file. Keeps Bash commands short and avoids permission prompts. - HEREDOCs for short content: Commit messages use
$(cat << 'EOF' ... EOF). Single-quoted'EOF'prevents variable expansion. - GPG sign every commit: Always
git commit -S. The sandbox cannot access GPG keys, so resort immediately to the unsandboxed command. - Never amend: Always create new commits. Pre-commit hook failures mean the commit did not happen, so
--amendwould modify the wrong commit. - Never use force or override flags: Never use
git push --force,git push -f,--no-verify, or similar override flags without explicit user instruction. If the user explicitly requests a force push, usegit push --force-with-lease(add--force-if-includeswhen the installed Git version supports it, v2.30+). Investigate root causes rather than forcing through. - Parallel tool calls over chained commands: Use separate Bash tool calls for independent commands instead of chaining with
;or&&, which trigger permission prompts. - Exclude secret files from staging: Never stage
.env,credentials.json,*.pem,*.key, or similar secret files. - Use clean diff output: Always pass
--no-ext-diff --no-color(and--no-pagerbefore the subcommand) on diff-producing commands (git diff,git log -p,git show). User configs may route diffs through external tools like difftastic, producing output that is harder to parse. These flags ensure standard unified diff format.
Quick Decision Table
| Scenario | Pattern | Reason | | -------------------------------- | ----------------------- | ------------------------------------- | | Commit messages | HEREDOC | Short, predictable length | | PR bodies (gh pr create) | Tmpfile + --body-file | Can be long; HEREDOC triggers prompts | | Issue bodies (gh issue create) | Tmpfile + --body-file | Can be long | | Review replies | Tmpfile + --body-file | Variable length | | Worktree prompts | Write tool to /tmp/ | Avoids shell escaping | | Tag messages | Inline -m | Typically one line |
Workflow
- Quick reference: Check the decision table above
- Tmpfile details: Read
references/tmpfile-pattern.md - HEREDOC details: Read
references/heredoc-pattern.md - Safety rules: Read
references/safety-rules.md - Common operations: Read
references/common-operations.md - Diff output: Read
references/diff-output.md
Reference Navigation
Quick reviews (default):
- The decision table above and the core principles cover most situations
Deep dives by topic:
references/tmpfile-pattern.md- When and how to use tmpfiles for long contentreferences/heredoc-pattern.md- When and how to use HEREDOCs for commit messagesreferences/safety-rules.md- GPG signing, never amend, never force, secret exclusion, parallel callsreferences/common-operations.md- Base branch detection, push with upstream fallback, conventional commits, branch namingreferences/diff-output.md- Clean diff output flags for bypassing external diff tools, colors, and pagers
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: cboone
- Source: cboone/agent-harness-plugins
- License: MIT
- Homepage: https://github.com/cboone/agent-harness-plugins
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.