commit-confirm

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install the commit skill from the LegendApp/legend-skills repository using the npx skills add command. This resource is maintained by the skill author.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from the local working tree (files, staged, and unstaged changes) to organize them into logical commit groups.
  • Ingestion points: Files and metadata within the Git working tree as specified in the 'Scope And Approval Override' section of SKILL.md.
  • Boundary markers: The skill explicitly mandates an approval-first workflow, requiring a manual 'go' from the user after a plan is presented and before any code is executed or staged.
  • Capability inventory: The skill facilitates working-tree inspection, staging, and committing (actions delegated to the $commit skill).
  • Sanitization: The process relies on the user's manual review of the proposed commit plan to mitigate risks from malicious content embedded in files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 05:26 PM