commitlint

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a comprehensive information resource for the commitlint ecosystem. All external links and suggested packages originate from the official project or reputable development platforms.
  • [PROMPT_INJECTION]: The skill describes functionality for reading and processing external data (git commit messages), which constitutes an indirect prompt injection surface.
  • Ingestion points: Git repository commit history accessed via the @commitlint/read API or the CLI (references/api/read.md, references/reference/cli.md).
  • Boundary markers: Absent; the tool focuses on structural validation of the message rather than protecting the LLM context from embedded instructions.
  • Capability inventory: Describes the execution of linting commands and Node.js scripts to analyze and format commit data.
  • Sanitization: Employs specific parsers (e.g., conventional-changelog) for linting, but these are not designed to sanitize content for security against LLM instruction override.
  • [EXTERNAL_DOWNLOADS]: Provides integration examples for CI/CD environments such as Azure Pipelines (references/guides/ci-setup.md) that utilize curl to interact with official platform APIs for retrieving commit metadata. These are standard, documented integration patterns for trusted cloud services.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 02:30 PM