git-maker
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed with a 'Safety Verifier' component that explicitly checks for secrets, credentials, and private keys before any commit is finalized.
- [COMMAND_EXECUTION]: Execution of Git commands is performed using the Bun.spawn API with structured argument arrays, which safely avoids the risks of shell command injection.
- [DATA_EXFILTRATION]: Network activity is strictly limited to 'git push' operations to remotes already configured by the user, with additional safeguards to block pushes from detached heads or to protected branches.
- [PROMPT_INJECTION]: The skill manages untrusted data from Git diffs through strict Conventional Commit formatting and localization rules. 1. Ingestion points: Git status and diff outputs are read in git-maker-fast.mjs and git-commit.mjs. 2. Boundary markers: The skill enforces Conventional Commit structure and specific Korean language output requirements. 3. Capability inventory: Tools are limited to Git staging, committing, and pushing. 4. Sanitization: Command execution uses safe argument passing via Bun.spawn.
Audit Metadata