ac-commit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Git diffs, which are considered untrusted external data, to generate commit messages and context entries.
- Ingestion points: Untrusted content is ingested via
git diff --cachedandgit diffduring the analysis and archiving phases. - Boundary markers: The instructions do not define specific delimiters or boundary markers to isolate the diff content from the sub-agent instructions.
- Capability inventory: The skill is authorized to perform Git commits, staging, and local file writes to the
.context/directory within the repository. - Sanitization: The skill includes a proactive security step in Phase 5 to scan for sensitive patterns (tokens, keys, and passwords) and redact them using a
[REDACTED]placeholder before writing to the history logs.
Audit Metadata