git-commit

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates repository operations by executing local git binaries and a provided Python helper script for message composition.
  • [SAFE]: The workflow implements a proactive safety scan during the preflight phase, which identifies and flags potentially sensitive files (e.g., .env, .pem, SSH keys) and large binary artifacts, requiring explicit user confirmation before they can be committed.
  • [SAFE]: The commit composer script (compose_commit_message.py) includes a built-in validation layer that rejects prohibited attribution trailers such as Co-authored-by or Committed via, ensuring that commit metadata remains clean and consistent with local history.
  • [SAFE]: The skill uses git commit -F with an intermediate temporary file to ensure commit messages are correctly handled as UTF-8 and to prevent shell-based injection or encoding issues that can occur when passing multi-line text directly through command arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:58 PM
Security Audit — agent-trust-hub — git-commit