git-commit
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a
PreToolUsehook triggered bygit commitcommands. It executes a local bash script (scripts/pre-commit-lint.sh) which attempts to run project-specific linters includingmake lint,npm run lint,ruff,flake8,rubocop, andgolangci-lintdepending on the project environment. - [PROMPT_INJECTION]: The skill analyzes external, untrusted data in the form of
git diffoutput to generate commit messages. This creates a surface for indirect prompt injection if a file being committed contains malicious instructions intended to influence the agent's commit message generation. - Ingestion points:
git diff --stagedandgit statusprocessed via theBashtool. - Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the diff content before analysis.
- Capability inventory: Access to
Bash(git commands),Read,Write,Edit, andTodoWritetools. - Sanitization: No explicit sanitization or filtering of the diff content is performed by the instructions.
Audit Metadata