Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward conventional commit message helper that reads staged Git changes and writes a local draft message file.
This appears safe to install if you want help drafting conventional commit messages. Be aware that invoking it may cause the agent to read staged diffs and recent Git history, so avoid staging secrets or sensitive material before using it, and consider narrowing the broad triggers if accidental activation would be disruptive.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Rules
- NEVER use `git commit --no-verify` or `-n`
- Write for humans, not to impress
- If pre-commit hooks fail, fix the issues
Using the trigger/identifier "commit" conflicts with a built-in command of the same name, creating a shadow-command condition. This can cause the skill to intercept or be selected instead of the expected built-in behavior, which is risky in a sensitive workflow that touches version-control operations.
The trigger list includes broad generic terms like "git" and "commit", which can cause this skill to activate in many unrelated contexts. That increases the chance of unintended invocation, command overlap, or user confusion, especially because the skill instructs the agent to inspect repository state and diffs.
No suspicious patterns detected.