git-visual-commits
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill configures a persistent global Git alias (
alias.bot) in the user's environment to support its identity-based commit workflow. This modification to the global Git configuration stays active across terminal sessions. - [DYNAMIC_EXECUTION]: The workflow involves the execution of a bundled PowerShell script (
scripts/validate-commit-subject.ps1) to validate the structure of commit subjects. The script is invoked usingpwshwith a path resolved from the skill's root directory. - [COMMAND_EXECUTION]: The skill relies on direct execution of Git commands and shell-based Git aliases. It also uses
git logcommands to verify commit authorship and message integrity immediately after execution. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data from the repository, such as diffs and untracked file contents, to categorize changes and draft commit messages.
- Ingestion points: The skill uses
git status --short --untracked-files=all,git diff, and path-specific inspections to gather data for the commit plan. - Boundary markers: Instructions require the agent to perform a complete read of
SKILL.mdto establish the operating context and use a strict subject format to delineate agent-generated content. - Capability inventory: The skill allows the agent to stage and commit files, modify global git settings, and run local scripts.
- Sanitization: Commit subjects are validated by a deterministic script (
scripts/validate-commit-subject.ps1) before presentation and before execution. - [EXTERNAL_DOWNLOADS]: The skill's documentation links to an asset hosted on GitHub's raw content domain (
raw.githubusercontent.com). This reference targets a well-known service for displaying a project-related image.
Audit Metadata