commit-confirm
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install the
commitskill from theLegendApp/legend-skillsrepository using thenpx skills addcommand. This resource is maintained by the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from the local working tree (files, staged, and unstaged changes) to organize them into logical commit groups.
- Ingestion points: Files and metadata within the Git working tree as specified in the 'Scope And Approval Override' section of
SKILL.md. - Boundary markers: The skill explicitly mandates an approval-first workflow, requiring a manual 'go' from the user after a plan is presented and before any code is executed or staged.
- Capability inventory: The skill facilitates working-tree inspection, staging, and committing (actions delegated to the
$commitskill). - Sanitization: The process relies on the user's manual review of the proposed commit plan to mitigate risks from malicious content embedded in files.
Audit Metadata