generate-commit-message
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill relies on
git diff --staged --statandgit diff --stagedto analyze code changes. These are standard, read-only git operations required for the skill's functionality. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted content from the codebase via git diffs, which creates a surface for indirect prompt injection.
- Ingestion points: The agent reads output from
git diff --stagedwhich contains code authored by users or potentially external sources. - Boundary markers: Absent. The skill does not define specific delimiters to isolate the diff content from the generation instructions.
- Capability inventory: Limited to read-only git command execution and text generation.
- Sanitization: Absent. The skill does not specify any sanitization or escaping for the ingested diff data.
Audit Metadata