ace-commit-msg
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the AI agent to execute local git commands (
git add -Aandgit commit -m "message") to automate the creation of commits. This is the primary intended function of the tool and is performed within the local repository environment. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it incorporates external data (chat history and file diffs) into its decision-making logic without explicit sanitization.
- Ingestion points: Context is derived from the conversation history and the output of
git diffas described inAGENTS.mdandcontent/process.md. - Boundary markers: There are no defined boundary markers or instructions to isolate or ignore embedded instructions within the analyzed data fields.
- Capability inventory: The skill is empowered to execute shell-level git commands based on the inferred data.
- Sanitization: No explicit sanitization or filtering is applied to the data used to construct the commit scope or behavior before execution.
Audit Metadata