skills/tartinerlabs/skills/commit/Gen Agent Trust Hub

commit

Pass

Audited by Gen Agent Trust Hub on Mar 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various Git and initialization commands as part of its primary workflow.
  • Runs git status, git stash, git pull, and git commit to manage repository state.
  • Executes npx husky init to set up Git hooks for the project.
  • Configures and executes gitleaks protect to scan staged files for potential secret leaks before committing.
  • [EXTERNAL_DOWNLOADS]: The skill fetches external packages during the initialization process.
  • Uses npx to download and run the husky package from the official npm registry.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the project metadata it analyzes.
  • Ingestion points: Reads package.json, commit histories, documentation, and conversation context to determine commit message formatting and GitHub issue references.
  • Boundary markers: No delimiters or instructions are used to prevent the agent from obeying instructions embedded in the analyzed code or documentation.
  • Capability inventory: The skill has the ability to execute shell commands (git, npx) and write configuration to local files (Husky hooks).
  • Sanitization: No validation or sanitization is performed on context-derived strings before they are incorporated into Git messages or command flows.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 8, 2026, 03:30 AM