commit-smart

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to interact with the local git repository.
  • Specific commands include git status, git diff, git add, and git commit.
  • These operations are limited to standard version control workflows and require user confirmation for destructive actions like committing.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external data from the git diff, which could potentially contain malicious instructions embedded in code comments or files.
  • Ingestion points: git diff --cached is read in Step 3 of SKILL.md to determine commit type and scope.
  • Boundary markers: No specific delimiters are defined to separate the code diff from instructions provided to the agent.
  • Capability inventory: The agent has the ability to execute git add and git commit commands.
  • Sanitization: The skill does not explicitly sanitize the diff content, but the impact is mitigated by the requirement for user confirmation in Step 6.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 05:49 PM