commit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a standard developer workflow for Git commits. Analysis of the instructions and code templates confirms that the skill operates within expected parameters for a developer agent.
- [COMMAND_EXECUTION]: The skill utilizes standard Git commands (
git commit,git add,git diff,git status). The provided command templates for Bash and PowerShell use secure string handling techniques, such as single-quoted heredocs (cat <<'EOF') and single-quoted here-strings (@' ... '@), which prevent shell expansion or injection from the commit message content. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local repository (diffs, logs, and a
.commit-scopesfile). While these are external inputs, the risk is mitigated by the skill's strict formatting rules and structured output requirements. The ingestion is necessary for the skill's primary purpose of analyzing code changes. - [DATA_EXPOSURE]: The skill reads repository-specific metadata (
.commit-scopes) and local Git state. It does not access sensitive system files (e.g., SSH keys, credentials) or perform any network operations.
Audit Metadata