conventional-commit
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a focused utility for managing Git commit workflows. It implements logic for splitting large changesets and ensuring message compliance through local validation scripts.
- [COMMAND_EXECUTION]: The skill utilizes local bash scripts (
scripts/check-commit-msg.shandscripts/check-commit-plan.sh) to validate commit headers. These scripts perform string validation using regular expressions and do not perform network operations or access sensitive system files. - [DYNAMIC_EXECUTION]: The file
evals/judge.pyuses thesubprocessmodule to run the skill's validation scripts against a local dataset for testing purposes. This is an internal development tool that operates on static test data and does not process untrusted external inputs during the agent's normal operation. - [INDIRECT_PROMPT_INJECTION]: The skill processes
git diffoutput to help the agent group changes. While this involves ingesting external data, the skill's capabilities are limited to Git staging and committing, and the resulting message headers are strictly validated against the Conventional Commits schema using localized scripts.
Audit Metadata