principled-git-commit

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill's primary purpose is to provide instructions and tooling for high-quality git commit messages. It does not perform any suspicious network operations or unauthorized file access.\n- [SAFE]: The skill includes explicit defensive mechanisms. Both the instructions in SKILL.md and the validate-commit-msg.sh script provide patterns to detect and block the commitment of sensitive information such as .env files, SSH keys (id_rsa), and literal secrets (e.g., bearer tokens, API keys) in commit bodies.\n- [SAFE]: The bundled scripts (analyze-history.sh, scaffold-dialect.sh, validate-commit-msg.sh) are transparent bash scripts that utilize standard command-line tools like grep, awk, sed, and git to perform their tasks. These scripts are intended for local execution by the developer to improve their workflow.\n- [SAFE]: All external URL references point to reputable developer resources, documentation for version control standards (e.g., conventionalcommits.org, keepachangelog.com), or well-known development blogs. No obfuscated or suspicious URLs were found.\n- [SAFE]: The skill follows established localization patterns by providing a Korean prose variant (lang/ko/SKILL.md) for human readers while maintaining English as the default for the commit convention itself.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 12:26 PM