skills/tbhb/vale-ai-tells/commit/Gen Agent Trust Hub

commit

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the ! syntax to execute scripts/preflight.sh during the skill load phase. This script populates the agent's context with essential repository metadata, branch status, and configuration details necessary for the commit workflow.
  • [EXTERNAL_DOWNLOADS]: The preflight.sh script performs a git fetch operation to the repository's configured origin. This is used to determine if the local default branch is synchronized with the remote, ensuring that the subsequent rebase operation target is current.
  • [COMMAND_EXECUTION]: The skill utilizes PreToolUse and PostToolUse hooks to execute shell scripts (guard-git.sh and stamp-review.sh). These scripts enforce workflow constraints by blocking direct git commit calls and verifying that commit messages have been approved by the required review sub-agents.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from git diffs and user-edited commit messages.
  • Ingestion points: Repository diffs gathered in preflight.sh and the contents of the COMMIT_AGENTMSG file.
  • Boundary markers: None explicitly present in the shell script execution; however, the workflow instructions mandate the use of fix-prose and review-commit-message skills to validate the content.
  • Capability inventory: The skill has the ability to execute repository-level commands including git commit, git fetch, and git rebase through its bundled scripts.
  • Sanitization: The skill relies on external validation steps (linters and sub-agent reviews) to verify the integrity and appropriateness of the commit message text before proceeding.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:23 AM