The Agent Skills Directory

[SAFE]: The skill includes a proactive 'Sensitive file check' (Step 3) that identifies potential credentials, secrets, and private keys (.env, credentials.json, *.key, etc.) before staging, preventing accidental data exposure.
[SAFE]: The execution of the git commit command uses a quoted HEREDOC pattern (cat <<'EOF') in Step 7, which is a secure method to ensure the generated commit message is treated as a literal string, preventing command injection or shell expansion.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local environment which could influence agent behavior.
Ingestion points: Step 1 reads file contents, git status, and git diff output into the agent's context.
Boundary markers: No explicit delimiters are specified for the ingested file contents.
Capability inventory: The skill can execute shell commands via git add and git commit in Step 7.
Sanitization: No explicit sanitization is performed on file contents, though the structured workflow and specific file list targeting reduce the surface for exploitation.

git-commit-tag