github-api-push-workaround

The skill declares broad trigger phrases around 'push GitHub', publishing repositories, token failure, and push troubleshooting, which can match common developer requests and auto-invoke guidance for state-changing remote operations. Because the skill is designed to generate commands for pushing code and changing repository settings, loose activation scope increases the chance of unintended use in contexts where the user did not explicitly request publication or remote modification.

This section describes generating push commands and private-to-public repository changes, both of which alter remote state and can expose source code or secrets if used incorrectly. The lack of an explicit warning about irreversible publication, branch/ref modification, and visibility changes is dangerous because users may follow generated commands without understanding the disclosure and integrity impact.

The usage section says the skill is triggered by natural-language keywords but does not define constrained boundaries, approval checks, or exclusions. In a skill that produces direct push commands and API workflows against remote repositories, unconstrained invocation increases the risk that benign troubleshooting requests are escalated into actionable instructions affecting remote code or repository configuration.

The Chinese section similarly instructs on remote push and private-to-public operations without clearly warning that these actions can disclose private code, tokens in history, or other sensitive repository contents. In context, the skill is operational and action-oriented, so omission of impact warnings materially raises the chance of accidental data exposure or unintended irreversible repository changes.

Line L13 lists activation phrases including '发布仓库到远端' and especially '令牌失效了', which are broad natural-language expressions that could arise in many contexts beyond this specific skill. The file does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.

The file hardcodes both English and Chinese sections as the presented documentation format, but does not state that language selection is optional or user-driven. Under the stated policy rule, locale/language constraints should either offer opt-in choice or be clearly justified.