git-commit-guide
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill metadata defines
scriptPath: check-git.shwithautoExecute: true. Because the content ofcheck-git.shis not provided in the skill payload, the agent would attempt to execute a file whose contents are unknown and unverifiable whenever Git-related triggers occur. - [EXTERNAL_DOWNLOADS] (MEDIUM): The README documentation encourages the user to execute
npm install -g commitizen cz-conventional-changelog. These are external, unversioned dependencies from the public NPM registry. While commonly used in development, suggesting global installation of external code without verification or pinning is a security risk. - [REMOTE_CODE_EXECUTION] (LOW): The documentation provides a bash script for a Git hook (
.git/hooks/commit-msg). While the provided snippet is a benign regex validator, Git hooks represent a persistence mechanism where code is automatically executed by the system during standard development workflows.
Audit Metadata