skills/jeremylongshore/tons-of-skills-marketplace/generating-conventional-commits/Gen Agent Trust Hub
generating-conventional-commits
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
scripts/generate_commit_message.pyandscripts/suggest_commit_type.pyexecute git commands usingsubprocess.runwith a list of arguments. This is a legitimate and expected implementation for a version control utility. The risk of command injection is minimized by avoiding shell string execution and using fixed command structures.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it ingests untrusted data in the form of git diffs from the project repository.\n - Ingestion points: Git diff content is read via subprocess in
scripts/generate_commit_message.pyandscripts/suggest_commit_type.py, and can also be read from files.\n - Boundary markers: The scripts do not use explicit delimiters or instructions to prevent the agent from following directions embedded within the diff content.\n
- Capability inventory: The skill uses
Bash(cmd:*)permissions to interact with the repository.\n - Sanitization: The scripts perform pattern matching on the diff lines but do not sanitize the content before it is processed or presented.
Audit Metadata