principled-git-commit
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is to provide instructions and tooling for high-quality git commit messages. It does not perform any suspicious network operations or unauthorized file access.\n- [SAFE]: The skill includes explicit defensive mechanisms. Both the instructions in
SKILL.mdand thevalidate-commit-msg.shscript provide patterns to detect and block the commitment of sensitive information such as.envfiles, SSH keys (id_rsa), and literal secrets (e.g., bearer tokens, API keys) in commit bodies.\n- [SAFE]: The bundled scripts (analyze-history.sh,scaffold-dialect.sh,validate-commit-msg.sh) are transparent bash scripts that utilize standard command-line tools likegrep,awk,sed, andgitto perform their tasks. These scripts are intended for local execution by the developer to improve their workflow.\n- [SAFE]: All external URL references point to reputable developer resources, documentation for version control standards (e.g.,conventionalcommits.org,keepachangelog.com), or well-known development blogs. No obfuscated or suspicious URLs were found.\n- [SAFE]: The skill follows established localization patterns by providing a Korean prose variant (lang/ko/SKILL.md) for human readers while maintaining English as the default for the commit convention itself.
Audit Metadata