git-step-commit

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute standard Git commands such as git add, git commit, and git push. It prioritizes safe operations by using interactive staging (git add -p), requiring rebase-based pulls, and preventing forced pushes by default.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including Git diffs and unversioned files, which represents an ingestion point for potentially malicious instructions. While it lacks explicit boundary markers for this data, it mitigates risk by instructing the agent to perform single-intent analysis and requiring confirmation of the commit plan when in 'review' mode. The skill has capabilities to perform file-write and network operations (push).- [DATA_EXPOSURE]: The skill interacts with local and global Git configuration files. It includes defensive instructions to prevent sensitive credentials, local caches, and build artifacts from being included in commits, and it specifically prohibits exposing credentials in repository URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 08:22 AM
Security Audit — agent-trust-hub — git-step-commit