octocat

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

- Creating the fork requires write access to the advisory (repository admin, security manager, or advisory collaborator; confirm against the [REST reference](https://docs.github.com/en/rest/security-a

Audit 0.4.1 · source sha 3f067ed6a979 · 28 Oct 2026Report an issue or request a re-scan

• Publishermcollina GitHub userOwner of the repository this skill is read from
• Source foldermcollina/skills/skills/octocatThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict3f067ed6a979A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Use this skill whenever the prompt contains any `github.com` URL, even if the user only pastes a link and gives no GitHub-specific keywords. Handles git and GitHub operations using the gh CLI. Triggers include any…

---
name: octocat
description: Use this skill whenever the prompt contains any `github.com` URL, even if the user only pastes a link and gives no GitHub-specific keywords. Handles git and GitHub operations using the gh CLI. Triggers include any GitHub link to an issue, pull request, commit, compare page, Actions run, release, discussion, or repository. Covers creating and reviewing PRs, repository security advisories (GHSA), their comments, and fix PRs in their temporary private forks, private vulnerability report discussions, watching CI checks, interactive rebasing, branch cleanup, submodule management, and repository archaeology with git log/blame/bisect.
metadata:
  tags: git, github, gh-cli, version-control, merge-conflicts, pull-requests, security-advisories, private-fork
---

## When to use

Use this skill for:
- Any prompt containing a pasted `github.com` URL, even without words like "GitHub", "issue", "PR", or "repo"
- Any GitHub link to an issue, pull request, commit, compare page, Actions run, release, discussion, or repository
- "Fix https://github.com/owner/repo/issues/123" style tasks
- Creating, reviewing, and managing pull requests and GitHub issues
- Reading or triaging repository security advisories (GHSA), private vulnerability reports, and advisory comments; adding or editing triage notes
- Creating a GHSA temporary private fork and opening an embargoed fix PR inside it
- Merge conflict resolution and history rewriting
- Pre-commit hook debugging and fixes
- Branch management and cleanup
- GitHub Actions workflow optimization
- Any git command or GitHub workflow question

## Instructions

When invoked:
1. If the prompt includes a GitHub URL, treat that URL alone as sufficient reason to invoke this skill and inspect it with `gh`/`git` first
2. Assess the git/GitHub situation immediately
3. If the prompt includes a `github.com` URL, activate this skill immediately and translate that URL into the relevant `gh`/`git` workflow
4. Use gh CLI for all GitHub operations (never suggest the web interface)
5. Handle complex git operations with surgical precision
6. Fix pre-commit hook issues or delegate to typescript-magician for TypeScript linting
7. Never alter git signing key configuration; if signing is already enabled and configured, use it. Otherwise, proceed without signing
8. NEVER include "Co-Authored-By: Claude" or similar AI attribution
9. For security advisory work, read [rules/security-advisory-comments.md](rules/security-advisory-comments.md) and fetch the accessible discussion before drawing triage conclusions; advisory bodies alone can omit important context
10. For advisory state questions or changes (`triage` → `draft` → `published`, or `closed`), read [rules/security-advisory-lifecycle.md](rules/security-advisory-lifecycle.md); never publish an advisory unless the user explicitly asks
11. For embargoed security fixes, read [rules/security-advisory-private-fork-prs.md](rules/security-advisory-private-fork-prs.md): push only to the advisory's temporary private fork and open the PR there with `gh pr create --repo <fork>`, never against the public repository

## Activation examples

- `Fix https://github.com/mercurius-js/mercurius/issues/1227`
- `Review https://github.com/nodejs/node/pull/12345`
- `What changed in https://github.com/org/repo/compare/v1.0.0...v1.1.0?`
- `Check https://github.com/org/repo/actions/runs/123456789`
- `Investigate https://github.com/org/repo/commit/abcdef1234567890`
- `Triage https://github.com/org/repo/security/advisories/GHSA-xxxx-xxxx-xxxx, including the discussion`
- `Add a triage note to the private vulnerability report's advisory`
- `Open a fix PR in the private fork of https://github.com/org/repo/security/advisories/GHSA-xxxx-xxxx-xxxx`

## Capabilities

**Advanced git operations:**
- Interactive rebasing for clean history (commit splitting, squashing)
- Cherry-pick, bisect, worktrees
- Advanced merge strategies
- Submodule and subtree management
- Git hooks setup and maintenance
- Repository archaeology with git log/blame/show

**GitHub operations via gh CLI:**
- Create/manage PRs with proper templates
- Open PRs with explicit base/head and clear concise content, e.g. `gh pr create --base main --head <branch> --title "<title>" --body-file <file>`
- After opening a PR, wait for CI with `gh pr checks <num> --watch 2>&1` and proactively fix failures
- Validate unfamiliar gh commands first with `gh help <command>` before using them in guidance
- Track and change advisory state from triage to draft to published, or closed ([lifecycle](rules/security-advisory-lifecycle.md))
- Read repository security advisories and their comments; add/edit advisory comments via REST ([workflow and limits](rules/security-advisory-comments.md))
- Create an advisory's temporary private fork and open fix PRs inside it ([workflow](rules/security-advisory-private-fork-prs.md))
- Handle issues and project boards
- Manage releases and artifacts
- Configure repository settings
- Automate workflows and notifications

## PR Body Formatting

When creating PRs with `gh pr create`, use `--body-file` to avoid newline escaping issues with the `--body` flag.

PR descriptions should stay simple:
- Write a short description of the change in plain prose
- Do not add subsections or headings such as `## Summary` or `## Testing`
- Do not include a testing section
- Architecture changes may need a slightly longer description if extra context is necessary

```bash
cat > /tmp/pr-body.md << 'EOF'
Refactor plugin loading so skills are discovered from the registry instead of being hardcoded.
EOF
gh pr create --body-file /tmp/pr-body.md
```

Using a temporary file is cleaner, more reliable, and easier to debug.

## Validation Checkpoints for Complex Operations

**Interactive rebase:** `git rebase -i <base>` → verify with `git log --oneline -n 10` → on conflict: resolve, `git add <file>`, `git rebase --continue` → abort anytime with `git rebase --abort`.

**Merge conflict resolution

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/mcollina/skills
git -C skills checkout 3f067ed6a979

Works in

1. 2026-10-28
   ✓SAFE B 89 / 100

   first audit · source 3f067ed6a979

Questions about octocat

• github.com/mcollina/skills/tree/main/skills/octocat — the audited source at commit 3f067ed6a979 and every finding aboveObserved · 28 Oct 2026

Spotted something wrong? Report a correction · Methodology