commit
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git and bash commands to stage files, check status, and perform commits. This is consistent with its stated purpose.\n
- Evidence: Staging via
git add <path>and committing viagit commit -F -with heredoc piping.\n- [COMMAND_EXECUTION]: Markdown instructions contain dynamic context injection placeholders to execute diagnostic checks at load time.\n - Evidence:
!bash "${CLAUDE_PLUGIN_ROOT}/.../exec-bit-check.sh"and!test -f "$HOME/.claude/source-control.md". These calls are restricted to local assets and plugin configuration.\n- [SAFE]: The included bash script for correcting executable bits on shebang files uses secure practices.\n - Evidence: It anchors to the repository root and handles symbolic links to prevent directory traversal or unauthorized file modifications.\n- [SAFE]: The skill enforces surgical staging and uses secure Bash heredoc syntax for committing messages.\n
- Evidence: Uses single-quoted heredocs (
<<'EOF') to prevent unintended shell expansion or command injection.
Audit Metadata