commitlint
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive information resource for the commitlint ecosystem. All external links and suggested packages originate from the official project or reputable development platforms.
- [PROMPT_INJECTION]: The skill describes functionality for reading and processing external data (git commit messages), which constitutes an indirect prompt injection surface.
- Ingestion points: Git repository commit history accessed via the
@commitlint/readAPI or the CLI (references/api/read.md,references/reference/cli.md). - Boundary markers: Absent; the tool focuses on structural validation of the message rather than protecting the LLM context from embedded instructions.
- Capability inventory: Describes the execution of linting commands and Node.js scripts to analyze and format commit data.
- Sanitization: Employs specific parsers (e.g., conventional-changelog) for linting, but these are not designed to sanitize content for security against LLM instruction override.
- [EXTERNAL_DOWNLOADS]: Provides integration examples for CI/CD environments such as Azure Pipelines (
references/guides/ci-setup.md) that utilizecurlto interact with official platform APIs for retrieving commit metadata. These are standard, documented integration patterns for trusted cloud services.
Audit Metadata