commitlint
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of commit messages through CLI redirection (e.g., from .git/COMMIT_EDITMSG) and stdin. The LLM Integration section specifically suggests a validation loop where generated messages are passed to a shell command without explicit boundary markers or sanitization.
- Ingestion points: CLI Usage and LLM Integration sections.
- Capability inventory: Shell command execution via subprocess.run and npx.
- Boundary markers: None present in the integration patterns.
- Sanitization: None provided for the input message content.
- [COMMAND_EXECUTION]: The skill instructs the agent on how to execute the commitlint CLI and provides Python code snippets that use the subprocess module to run shell commands.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official packages such as @commitlint/cli and @commitlint/config-conventional from standard package registries.
Audit Metadata