lov-git-commit-with-context
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git status outputs and diffs to generate commit messages. The workflow in SKILL.md mandates a manual confirmation step where the user reviews staged hunks and the generated message before the commit is finalized, effectively mitigating risks from malicious instructions embedded in the codebase.
- [COMMAND_EXECUTION]: The skill performs Git operations such as staging and committing changes. The instructions in SKILL.md explicitly require that project-specific hooks are executed and that safety-skipping parameters (such as --no-verify) are not used, maintaining the security integrity of the local development environment.
- [DYNAMIC_EXECUTION]: The provided validation utility
scripts/validate_skill.pyusesyaml.safe_load()to process YAML content. This is a secure implementation that prevents arbitrary code execution during the parsing of skill metadata and configuration files. - [DATA_EXPOSURE]: The
scripts/profile_store.pyscript manages local identity and preference data. It includes a security filter (SENSITIVE_PARTS) designed to identify and block the storage of credentials such as tokens, secrets, passwords, and API keys within the shared user profile.
Audit Metadata