git-commit-push-pr
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses
gitandgh(GitHub CLI) for its core functionality. All commands are well-structured and relevant to the stated purpose of managing Git workflows. - [SAFE]: Data ingestion from
git diffandgit logis handled using heredocs (EOF) when passed to commit or PR creation commands, which effectively prevents command injection from file content into shell commands. - [SAFE]: The skill includes a "Systematic" badge in PR descriptions that links to the author's GitHub repository (
marcusrbrown/systematic). This is a legitimate vendor resource used for attribution and version tracking. - [SAFE]: Dynamic context injection (
!command) is used solely to gather project state (Git status, branch info, existing PRs) at load time, with no evidence of sensitive data harvesting or exfiltration. The use ofjqto read a local plugin version is also a benign administrative task.
Audit Metadata