commit-workflow

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs local repository operations using git commands (e.g., git status, git diff, git commit) to manage staged files and create commits.
  • [DYNAMIC_EXECUTION]: The workflow includes a quality check step that executes project-defined scripts such as lint, test, and build via the detected package manager (npm, yarn, pnpm, or bun). This behavior is standard for development environments to ensure code quality before code is committed.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and version control state. It implements security guardrails by explicitly instructing the agent to exclude sensitive files, such as .env and credential tokens, from the commit process.
  • Ingestion points: Reads package.json, git status output, and git diff content in SKILL.md.
  • Boundary markers: None specific to data interpolation, but follows a structured step-by-step workflow.
  • Capability inventory: Executes shell commands for git operations and package manager scripts in SKILL.md.
  • Sanitization: Includes a specific 'Guardrails' section in SKILL.md to prevent the inclusion of secrets in commits.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 10:03 AM