commit-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local repository operations using
gitcommands (e.g.,git status,git diff,git commit) to manage staged files and create commits. - [DYNAMIC_EXECUTION]: The workflow includes a quality check step that executes project-defined scripts such as
lint,test, andbuildvia the detected package manager (npm, yarn, pnpm, or bun). This behavior is standard for development environments to ensure code quality before code is committed. - [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and version control state. It implements security guardrails by explicitly instructing the agent to exclude sensitive files, such as
.envand credential tokens, from the commit process. - Ingestion points: Reads
package.json,git statusoutput, andgit diffcontent inSKILL.md. - Boundary markers: None specific to data interpolation, but follows a structured step-by-step workflow.
- Capability inventory: Executes shell commands for git operations and package manager scripts in
SKILL.md. - Sanitization: Includes a specific 'Guardrails' section in
SKILL.mdto prevent the inclusion of secrets in commits.
Audit Metadata