Commit Helper
v2.0.0Cz Cli — Commitizen — conventional commit helper. Automated tool for cz-cli tasks. Use when you need Cz Cli capabilities. Triggers on: commit helper.
⭐ 0· 307·1 current·1 all-time
bybytesagain4@xueyetianya
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Commitizen-style commit helper) matches the provided scripts and SKILL.md. The cz_cli.sh implements commit message generation, types, changelog generation, validation, linting, and other commit-related functionality. There are no unrelated credentials, binaries, or external services required.
Instruction Scope
SKILL.md instructs the agent to run scripts/cz_cli.sh <command>, which is appropriate. The cz_cli.sh legitimately runs git commands (git log) to read commit messages and generates output. One minor inconsistency: scripts/script.sh is included in the bundle but is not referenced by SKILL.md; script.sh is a generic utility that creates a data directory and writes logs/data, which is beyond the documented cz_cli usage. Also note: cz_cli.sh outputs commit history and messages — these outputs may contain sensitive repository information if the agent transmits them externally.
Install Mechanism
No install spec or remote downloads are used; the skill is instruction/code-only and relies on standard system tools (git, grep, sed). Nothing is written to disk beyond the included scripts except the deliberate data directory used by script.sh.
Credentials
The skill requires no environment variables or credentials. The only environment usage is script.sh honoring COMMIT_HELPER_DIR or XDG_DATA_HOME/HOME for its local data directory, which is a proportionate configuration mechanism.
Persistence & Privilege
always:false and no special privileges requested. However, scripts/script.sh will create a per-user data directory (defaulting to $XDG_DATA_HOME or $HOME/.local/share/commit-helper) and write history.log and data.log there. This is expected for a local CLI tool but is persistent filesystem activity the user should be aware of.
Assessment
This skill is internally consistent with its stated purpose. Before installing: (1) review the included scripts (cz_cli.sh and script.sh) yourself — they are plain bash and easy to read; (2) be aware that cz_cli.sh runs git log and will output commit messages (avoid running it against repos with sensitive commit contents unless you trust the environment); (3) note that script.sh will create ~/.local/share/commit-helper (or a directory pointed to by COMMIT_HELPER_DIR/XDG_DATA_HOME) and write logs/data — if you prefer no on-disk state, don't invoke script.sh; (4) there are no network calls or required secrets; if you want extra caution, run the scripts in a sandboxed environment or inspect the files locally before enabling agent invocation.Like a lobster shell, security has layers — review code before you run it.
latestvk97cpxwncx8v4td9fb00pxwdrx833k48
License
MIT-0
Free to use, modify, and redistribute. No attribution required.