commit
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local repository data through standard Git commands (status, diff, log) to perform its stated function. No network operations or attempts to access sensitive files outside the project scope were detected.
- [DYNAMIC_EXECUTION]: The skill uses shell commands to interact with the Git CLI. It employs a secure quoted HEREDOC pattern (
'EOF') when passing generated commit messages to the shell, which effectively prevents shell expansion and command injection even if the generated text contains special characters. - [INDIRECT_PROMPT_INJECTION]: While the skill processes external data (diff outputs) that could contain malicious instructions, the impact is limited to the generation of a commit message. The skill includes step-by-step logic for the agent to analyze changes rather than blindly following instructions found in the code, and the final action is a standard Git operation.
- [SAFE]: The skill's behavior is entirely consistent with its metadata and description as a 'commit' utility. It does not use external dependencies, remote code, or elevated privileges.
Audit Metadata