conventional-commits
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions are focused on formatting Git-related strings (commits, branches, PRs). No obfuscation, data exfiltration, or unauthorized command execution patterns were found.- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where untrusted data (git diffs) could influence agent output. \n
- Ingestion points:
git statusandgit diffas mentioned in the 'Making a commit' section (SKILL.md). \n - Boundary markers: The skill includes a 'Verify' section with a checklist that requires the agent to re-read the drafted message against the spec and the actual diff before committing. \n
- Capability inventory: The agent is instructed to use
git commit,git checkout,gh pr create, andgh issue create. \n - Sanitization: No explicit sanitization or escaping of the diff content is described before it is used to draft the message.
Audit Metadata