commit
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely within the local repository context to assist with commit message generation. No external network requests, data exfiltration, or credential access were identified.
- [COMMAND_EXECUTION]: The skill utilizes standard version control commands (
git diff --cachedandgit commit). These are appropriate for the tool's purpose and are constrained to staged changes. - [PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface as it processes code changes that could contain malicious instructions. However, it effectively mitigates this risk by requiring user confirmation before executing any commit.
- [INDIRECT_PROMPT_INJECTION_EVIDENCE]: 1. Ingestion points: Staged code changes entering the context via
git diff --cached(SKILL.md). 2. Boundary markers: The prompt clearly separates task instructions from the data analysis phase. 3. Capability inventory: Execution of git commands (SKILL.md). 4. Sanitization: Requirement for user review and confirmation before command execution.
Audit Metadata