signal-commit

SUSPICIOUS. The skill's core behavior matches its stated purpose as a git commit helper, and there are no third-party installers, credential prompts, or hidden network intermediaries. However, it is high-friction from a safety standpoint: zero-confirmation execution, blanket `git add -A`, optional immediate push, and PowerShell `ExecutionPolicy Bypass` make it risky for an AI agent to run autonomously even though it is not clearly malicious.