commit-message
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to assist with developer workflows by generating commit messages based on staged and unstaged changes. It uses standard Git commands (
git status,git diff) which are appropriate for its stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes untrusted data from repository diffs and file contents.
- Ingestion points: Data enters the context through
git diffandgit statuscommand outputs as described in the Process section ofSKILL.md. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the processed diffs.
- Capability inventory: The skill is limited to
git statusandgit difftools as defined in theallowed-toolsmetadata. - Sanitization: No explicit sanitization or filtering of the diff content is performed before generating the commit message.
Audit Metadata