ssd-git-commit
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install
@release-it/conventional-changelogandrelease-itfrom the npm registry. These are established tools used in the software development ecosystem for managing releases and automated versioning. - [COMMAND_EXECUTION]: The documentation includes shell commands for global package installation (
npm install -g), Git branch management (git checkout), and executing the release utility (release-it). These are standard operational commands for developers. - [INDIRECT_PROMPT_INJECTION]: The skill outlines a process where the agent generates commit messages based on project changes, which presents a surface for indirect instructions to influence the output.
- Ingestion points: The agent processes external data such as code diffs, file contents, and issue references (e.g.,
SKILL.md) to formulate commit descriptions. - Boundary markers: The instructions do not define specific delimiters to separate the data being summarized from the generation instructions.
- Capability inventory: The skill documentation involves the use of Git and NPM commands.
- Sanitization: There is no mention of filtering or sanitizing input data before it is used to generate the commit message.
Audit Metadata