skills/mgiovani/cc-arsenal/git-commit/Gen Agent Trust Hub

git-commit

Pass

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill implements a PreToolUse hook triggered by git commit commands. It executes a local bash script (scripts/pre-commit-lint.sh) which attempts to run project-specific linters including make lint, npm run lint, ruff, flake8, rubocop, and golangci-lint depending on the project environment.
  • [PROMPT_INJECTION]: The skill analyzes external, untrusted data in the form of git diff output to generate commit messages. This creates a surface for indirect prompt injection if a file being committed contains malicious instructions intended to influence the agent's commit message generation.
  • Ingestion points: git diff --staged and git status processed via the Bash tool.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the diff content before analysis.
  • Capability inventory: Access to Bash (git commands), Read, Write, Edit, and TodoWrite tools.
  • Sanitization: No explicit sanitization or filtering of the diff content is performed by the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 26, 2026, 08:41 PM
Security Audit — agent-trust-hub — git-commit