Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward git commit helper whose Bash use and repository changes are disclosed and aligned with its purpose.
Before installing, be aware that this skill can stage files and create git commits. Review the diff and staged files first, and override the commit language or AI-GEN footer if your project has different conventions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
git add -p
**Never commit secrets** (.env, credentials.json, private keys).
### 3. Generate Commit Message
The trigger description is broad enough to activate on very common commit-related phrasing, which can cause the agent to invoke this skill in contexts the user did not clearly intend. Because the skill can run Bash and perform real git staging/commit actions, unintended activation could lead to unauthorized repository changes or accidental commits.
Mandating Simplified Chinese commit messages without user opt-in can override user or project requirements and cause operational mistakes, especially in repositories with established language or formatting policies. While not a direct code-execution issue, it can result in policy violations, workflow friction, and misleading automated commits.
Repeating the mandatory Simplified Chinese requirement in best practices reinforces behavior that may conflict with user expectations or repository standards. This increases the likelihood that the agent will ignore contextual cues and produce commits that are noncompliant or confusing to collaborators.
No suspicious patterns detected.