commit-assisted-by
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Git commands (
git commit,git log,git rebase) and a local shell script (safety-check.sh) to manage commit metadata. These operations are restricted to the local repository context. - [REMOTE_CODE_EXECUTION]: Mode 3 utilizes
git rebase --execto perform bulk updates on a branch. The command executed for each commit is defined within the skill's instructions and involves parsing existing trailers to avoid duplicate entries. This is a standard Git automation pattern. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of Git commit messages when checking for existing trailers (
git log -1 --format=%B). However, the data is piped directly togit interpret-trailersandgrepfor pattern matching, which does not involve LLM interpretation or execution of the content, effectively mitigating injection risks. - [SAFE]: All external resources and references, including the safety script, are internal to the skill package or standard system utilities (Git). The logic includes multiple safeguards, such as verifying if a commit has been pushed to a remote branch before attempting to amend it.
Audit Metadata