conventional-commits
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a bundled Node.js script (
scripts/check-commit-message.mjs) to automate the validation of Git commit headers. - [DATA_EXFILTRATION]: The validator script reads local files provided as command-line arguments to check their content against the Conventional Commits rules. This access is restricted to reading local file content for validation and does not involve network activity.
- [PROMPT_INJECTION]: The skill processes external commit message text, which creates an indirect prompt injection surface. The validator script mitigates this risk by using regular expressions to enforce a strict schema without interpreting the data as instructions.
- Ingestion points: The validator reads from file paths or standard input via the
readMessagefunction inscripts/check-commit-message.mjs. - Boundary markers: No specific delimiters or boundary warnings are present in the validation instructions.
- Capability inventory: The skill uses local shell execution to run the validation script; no other high-privilege capabilities are used.
- Sanitization: The script filters Git comment lines and validates the header using a predefined regular expression.
Audit Metadata