commit-message
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
git rev-parse --show-toplevelto identify the repository root andgit diff --cachedto retrieve staged changes. These operations are essential for the skill's primary function and are performed within the local repository context. - [SAFE]: The skill processes untrusted data from Git diffs, which represents a surface for indirect prompt injection. This risk is evaluated as safe because it is inherent to the skill's primary purpose of summarizing code changes and does not involve elevated privileges or network capabilities.
- Ingestion points: Staged changes retrieved via Git diff in
SKILL.md(Workflow Step 2). - Boundary markers: None explicitly defined to separate diff content from analysis instructions.
- Capability inventory: Subprocess execution of
gitcommands restricted to repository state. - Sanitization: None detected; the LLM processes raw diff output.
- [SAFE]: The skill references the official Conventional Commits specification website for documentation and formatting guidelines.
Audit Metadata