The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze_diff.py uses subprocess.run to execute git commands (such as git diff, git rev-parse). This is the intended behavior of the tool to gather information about repository changes. The implementation uses a list-based argument format and avoids shell=True, which is a secure practice to prevent shell injection vulnerabilities.
[DATA_EXPOSURE]: The skill reads file names and diff statistics from the local git repository. This information is processed locally to generate commit messages and is only output to the user's terminal or as a JSON object, with no external exfiltration or network activity detected.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a git repository (filenames and diff contents). However, the logic is limited to regex-based classification (e.g., detecting if a path contains 'tests' or 'docs') and statistical analysis. It does not interpret or execute instructions found within the repository content, making the risk of indirect injection negligible.
[SAFE]: No obfuscation, remote code execution, or persistence mechanisms were found. The skill does not require external dependencies and uses standard Python library modules.

smart-commit-gen