Git Smart Commit

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.0.0

Overview

This appears to be a commit-assistance skill whose diff-reading behavior is expected for its purpose, with no evidence of hidden persistence or automatic commits.

Install if you want help summarizing staged changes or preparing commit text. Be aware that repository diffs may include sensitive code or accidental secrets, and only invoke it in repositories where you are comfortable having staged changes inspected.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description contains broad activation phrases such as requests to commit changes, generate a commit message, or describe staged changes. These can overlap with common developer interactions and cause the skill to trigger in situations the user did not explicitly intend, increasing the chance it will inspect repository diffs or propose commit actions on sensitive code changes.

VirusTotal

66/66 vendors flagged this skill as clean.