git-conventional-commits
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
bashtool to perform version control tasks such as staging files (git add) and committing changes (git commit). It also analyzes the repository state usinggit statusandgit diffto automatically suggest appropriate commit types.\n- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it processes content from the local repository to generate commit messages.\n - Ingestion points: Data enters the process through
git statusandgit diffcommands executed inhandlers/commit-with-preview.md.\n - Boundary markers: The system uses specific commit message rules (e.g., length limits, imperative mood) defined in
rules/message-validation.mdto guide the AI's output.\n - Capability inventory: The skill has the ability to stage files and create new commits in the local git repository.\n
- Sanitization: A mandatory review step is implemented in
handlers/format-and-preview.md, where the generated message is written to a session-specific preview file and the user must provide explicit confirmation via theask_usertool before the commit is executed.
Audit Metadata