qui-conventional-commits

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a plain Conventional Commits writing guide with no code, secrets handling, network access, or automatic git actions.

Reasonable to install if you want commit-message formatting help. Be aware it may influence responses for broad commit-related prompts; review generated commit messages before using them, especially to avoid including sensitive details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description is broad enough to activate on generic mentions of commits or commit messages, which can cause the skill to be invoked outside the user's actual intent. This is not directly exploitable for code execution or data access, but it can lead to inappropriate routing, user confusion, and unnecessary influence over responses in common developer workflows.

VirusTotal

66/66 vendors flagged this skill as clean.