git-workflow

This skill is a documentation/instruction artifact that scaffolds git conventions, commit message generation, changelog and release automation, hook setup, and templates for Laravel and JS projects. It does not contain direct malicious code, remote unknown download-and-execute patterns, credential exfiltration, or references to suspicious external endpoints. The primary security concerns are standard supply-chain risks: it instructs installing development dependencies via composer/npm and configuring hooks that will run local binaries (transitive trust), and it uses the gh CLI to perform privileged repository actions which require the user's GitHub credentials. Those behaviors are proportionate to the described purpose but warrant normal operational caution: verify packages and pin versions, review hook scripts before enabling, and run CLI release actions with appropriate checks. Overall, I assess this as low-risk guidance with moderate supply-chain considerations rather than malicious intent.