Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Git commit helper; it can create or amend commits, which is expected for its purpose but should be used only after reviewing staged changes.
Before installing, understand that /commit may create a real Git commit and /commit --amend may alter the latest commit. Review staged files with git diff --staged and use /commit --dry-run when you only want a proposed message.
The manifest says the skill analyzes staged changes and generates commit messages, but the documented commands also perform state-changing actions like git commit and --amend. This scope expansion is dangerous because a user or calling agent may treat the skill as read-only analysis when it can actually persist changes or rewrite recent history.
The command list exposes /commit -m and /commit --amend, both of which modify repository state, but the skill does not clearly warn that these actions create commits or rewrite the previous one. In an agent setting, missing warnings can cause unintended persistence of sensitive code or accidental history alteration.
The workflow proceeds from analysis directly to executing git commit, but it lacks an explicit safety boundary that this step will permanently record all staged changes in version control. That creates a real risk of unintended commits, including secrets, incomplete work, or policy-violating code, especially if an autonomous agent follows the workflow literally.
The initial-commit edge case suggests automatically creating a commit when HEAD does not exist, without a warning that this changes repository state. Automatic first commits are especially risky because users may not realize all staged content, including accidental files, will become part of project history.
The manifest centers on analyzing already staged changes via git diff --staged. But the edge-case guidance says to run git status and prompt the user about staging all changes, expanding the skill's role from staged-diff analysis into helping decide what to stage.
