git-commit

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local shell script scripts/context.sh and the yarn scopes command. These are used to gather the current Git status, diffs, and available project scopes to help generate accurate commit messages. These are standard development operations.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) as it reads data from the local file system that could contain malicious instructions.\n
  • Ingestion points: The scripts/context.sh script reads git status, git diff, and the content of untracked files.\n
  • Boundary markers: The script output uses structural headers (e.g., ## git diff) and delimiters for untracked files.\n
  • Capability inventory: The skill is authorized to stage and commit changes to the repository.\n
  • Sanitization: No specific sanitization or filtering is applied to the gathered Git context.\n- [DATA_EXFILTRATION]: The skill exposes repository information, such as code changes and commit history, to the agent's context. This is necessary for the skill's primary function and the data is not transmitted to any external or unauthorized systems.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 01:47 PM
Security Audit — agent-trust-hub — git-commit