setup-conventional-commits

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash scripts (conventional-commits-check.sh) to intercept and validate shell commands. This is the intended purpose of the hook mechanism to enforce project standards.
  • [DYNAMIC_EXECUTION]: The hook script uses relative path sourcing (source "$(dirname "$0")/_hook-lib.sh") to load shared logic. The library file _hook-lib.sh itself points to a relative location (../../shared/hook-lib.sh), which is a common pattern for shared utilities in development environments.
  • [SAFE]: No network exfiltration, prompt injection, or credential harvesting patterns were detected. The skill performs localized validation of commit messages and provides helpful feedback to the user via the hook_deny function.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 09:06 AM
Security Audit — agent-trust-hub — setup-conventional-commits