The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the run_command tool to execute git operations including git status, git diff, and a combined git add . && git commit command. While git add . is a broad operation that stages all changes in the directory, it is aligned with the skill's stated purpose of committing changes.
[PROMPT_INJECTION]: The skill processes untrusted data from local files using view_file and git diff to generate its output. This creates an indirect prompt injection surface where malicious content within the files being committed could attempt to influence the agent's behavior.
[PROMPT_INJECTION]: The skill provides a specific security constraint: "NEVER use double quotes (") in the commit message content". This serves as a manual sanitization measure to prevent the generated text from breaking out of the shell's string delimiters in the git commit -m "..." command, effectively mitigating simple command injection attacks.

git-commit-message