/git-profile

name: git-profile
description: "Git identity and GPG signing profile manager. Discovers profiles from GPG + git config, switches local identity, checks signing health. Use when: user says 'switch identity', 'git profile', 'check signing', 'gpg key status', 'which identity', or /git-profile"
allowed-tools: Bash(bash:*), Bash(git:*), Read, Grep, Glob, AskUserQuestion
argument-hint: "[doctor|list|use <profile>|remove <profile>|verify]"

Git Profile Manager

Manage git identity and GPG signing profiles per-repository.

Workflow

sequenceDiagram
    participant U as User
    participant SK as SKILL.md
    participant SH as git-profile.sh
    participant AQ as AskUserQuestion

    U->>SK: /git-profile [subcommand]
    SK->>SK: Parse subcommand (default: doctor)

    alt doctor (default)
        SK->>SH: doctor
        SH-->>SK: Diagnostic JSON
        SK->>U: Health report table
    end

    alt list
        SK->>SH: list
        SH-->>SK: Profiles JSON
        SK->>U: Profile table with current match
    end

    alt use <profile>
        SK->>SH: resolve <profile>
        SH-->>SK: Plan JSON + plan-hash
        SK->>AQ: "Apply [hash] to local config?" / "Abort"
        AQ-->>SK: Approved
        SK->>SH: apply --plan-hash <hash>
        SH-->>SK: Result JSON
        SK->>U: Applied / Error
    end

    alt remove <profile>
        SK->>SH: remove-check <profile>
        SH-->>SK: Safety JSON (active repos list)
        alt profile is active
            SK->>AQ: "Profile active in N repos. Remove anyway?" / "Cancel"
        end
        SK->>SH: remove-exec <profile> [--force]
        SH-->>SK: Result JSON
        SK->>U: Removed / Error
    end

    alt verify
        SK->>SH: verify
        SH-->>SK: Verification JSON
        SK->>U: Verification report
    end

Subcommands

`doctor` (default)

Run diagnostics on current repository's git identity and GPG signing config.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh doctor` 2. Parse the JSON output 3. Render a health report table:

## Git Profile Health

| Item | Value | Source | Status |
|------|-------|--------|--------|
| Name | ... | ... | ... |
| Email | ... | ... | ... |
| Signing | ... | ... | ... |
| GPG Key | ... | ... | ... |
| Env Override | ... | ... | ... |
| Worktree | ... | ... | ... |
| Profile Match | ... | ... | ... |

Status: [overall status]

1. If `status` is `halt`: show the issue and stop 2. If `status` is `warn`: show warnings, continue 3. If registry is missing AND this is the first run: trigger auto-discovery (see below)

`list`

List all registered profiles.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh list` 2. Parse the JSON output 3. Render a profile table with a marker on the currently matched profile

`use <profile>`

Switch the current repository to use a named profile.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh resolve <profile>` 2. Parse the plan JSON — contains profile data, planned commands, and plan-hash 3. Show the user what will be written:

## Apply Profile: <profile-id>

| Config Key | Current | New |
|------------|---------|-----|
| user.name | ... | ... |
| user.email | ... | ... |
| user.signingkey | ... | ... / (unset) |
| commit.gpgsign | ... | true / (unset) |

Note: Keyless profiles unset signing-related keys instead of setting them.

1. Use `AskUserQuestion` with options:

• `"Apply [<plan-hash>] to local config (Recommended)"`
• `"Abort"`

2. On approval: `bash scripts/run-skill.sh git-profile git-profile.sh apply --plan-hash <hash>` 3. Parse result; if error (hash mismatch, write failure) report and stop 4. On success: report applied config

`remove <profile>`

Remove a profile from the registry.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh remove-check <profile>` 2. If profile is active in any repo, use `AskUserQuestion`:

• `"Profile is active in N repos. Remove with --force?"`
• `"Cancel"`

3. On approval: `bash scripts/run-skill.sh git-profile git-profile.sh remove-exec <profile> [--force]` 4. Report result

`verify`

Deep verification of current identity setup.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh verify` 2. Parse the verification JSON 3. Render verification report with checks:

• Key expiry (90-day warning threshold)
• Email match between git config and GPG key UID
• Registry consistency

Auto-Discovery

Triggered when: registry file is missing on first `doctor` run.

**Steps:** 1. Run: `bash scripts/run-skill.sh git-profile git-profile.sh discover` 2. Parse candidates JSON 3. Present candidates to user via `AskUserQuestion`:

• `"Save N discovered profiles to registry (Recommended)"`
• `"Skip — I'll configure manually"`

4. If approved, the discover command already persisted them; confirm to user 5. If skipped, create an empty registry to avoid re-prompting

Safety Rules

| Rule | Description | |------|-------------| | v1 NEVER writes `~/.gitconfig` | Only `--local` scope writes | | v1 NEVER enables `extensions.worktreeConfig` | Linked worktree: detect + warn only | | NEVER auto-fix without confirmation | All writes gated by AskUserQuestion | | NEVER store key material | Registry stores fingerprints only | | Plan-hash verification | Re-compute hash before apply; reject if stale | | Atomic registry writes | temp file + `chmod 0600` + `mv` |

Diagnostic Integration

The `doctor --json` output follows the Shared Diagnostic Contract (see tech spec section 3.2). Other skills (e.g., `/smart-commit` Step 1c) can call:

bash scripts/run-skill.sh git-profile git-profile.sh doctor --json

**Degradation policy**: If the script is not found or fails, the calling skill falls back to its own inline diagnostics. Infrastructure failure = warn-only; identity/signing missing = halt (unchanged).