conventional-commit

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a focused utility for managing Git commit workflows. It implements logic for splitting large changesets and ensuring message compliance through local validation scripts.
  • [COMMAND_EXECUTION]: The skill utilizes local bash scripts (scripts/check-commit-msg.sh and scripts/check-commit-plan.sh) to validate commit headers. These scripts perform string validation using regular expressions and do not perform network operations or access sensitive system files.
  • [DYNAMIC_EXECUTION]: The file evals/judge.py uses the subprocess module to run the skill's validation scripts against a local dataset for testing purposes. This is an internal development tool that operates on static test data and does not process untrusted external inputs during the agent's normal operation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes git diff output to help the agent group changes. While this involves ingesting external data, the skill's capabilities are limited to Git staging and committing, and the resulting message headers are strictly validated against the Conventional Commits schema using localized scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 01:06 PM