Security audit

git-commit-helper

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward git commit helper that inspects repository changes and commits only after the workflow tells the agent to get user approval.

Before installing, be comfortable with the agent reading your git status and committing repository changes. Use it only when you intend to create a commit, review the displayed file scope and message carefully, and exclude any files you do not want staged or committed.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase "commit" is overly generic and can activate the skill during ordinary discussion rather than a clear request to create a git commit. In this skill, activation can lead to repository inspection and eventually a commit workflow, so accidental invocation increases the chance of unintended source-control actions or disclosure of change details.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: In commit mode, the script directly runs `git add` and `git commit`, which changes repository state and can stage more content than the user intended, especially via `git add -A`. The skill description says it should confirm with the user before committing, but this safety check is not enforced in the script itself, so any caller that invokes `commit` can cause an immediate commit without an in-script confirmation barrier.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.