commit
Audited by Socket on Mar 10, 2026
1 alert found:
Obfuscated FileThe Commit skill is coherent with its stated purpose: it analyzes uncommitted changes, enforces atomic commits with conventional formats, and optionally pushes. The data flows are typical for a local Git workflow, with an explicit validation step and a documented output format. The footprint remains proportionate for a developer tool, with no obvious credential exfiltration, rogue binaries, or unnecessary elevated privileges. The main concerns are around trust of the local validator script (is it from a verified source?) and clarity around how user input from AskUserQuestion is handled in constructing commit messages. Overall, the skill is BENIGN with notable caution warranted around the source of the validator and potential prompts influencing command execution.