Back to skill
Skillv1.0.0
ClawScan security
Git Smart Commit · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 12, 2026, 2:33 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions and requirements are coherent with its stated purpose (generating Conventional Commit messages from staged git changes); no unexpected credentials, installs, or unrelated actions are requested — minor note: the SKILL.md assumes the git CLI is available but the manifest didn't list it as a required binary.
- Guidance
- This skill appears to do exactly what it says: it reads your git diffs and proposes Conventional Commit messages, and can run git commit if approved. Before installing or using it: (1) ensure the git CLI is available on the agent/runtime (the skill assumes git but didn't declare it), (2) be aware the agent will read diffs from your working tree — avoid committing secrets or sensitive data without review, (3) prefer using --dry-run first or require explicit user approval before committing, and (4) review generated commit messages before allowing an automatic commit or amend.
Review Dimensions
- Purpose & Capability
- noteName/description match the instructions: it analyzes staged diffs and produces Conventional Commits messages and can run git commit. However, the skill's manifest lists no required binaries while the runtime steps clearly require the git CLI (git diff, git commit). This is a small metadata mismatch but not a functional incoherence.
- Instruction Scope
- okSKILL.md stays within scope: it directs the agent to run git diff/git commit, analyze diffs, infer type/scope/subject, and optionally stage/amend/commit. It does not instruct reading unrelated files, contacting external endpoints, or accessing unrelated credentials. It may recommend staging all changes if nothing is staged — the agent should confirm with the user before making changes.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files; this has the lowest install risk. Nothing is downloaded or written to disk by the skill itself.
- Credentials
- noteNo environment variables or credentials are requested, which is appropriate. The only proportionality issue is the missing declared dependency on the git binary. Also, the skill will read repository diffs (including staged and possibly unstaged content if user chooses to stage everything) — that means local code and any secrets contained in diffs could be observed by the agent during analysis; this is expected behavior for a commit-message helper but worth the user's awareness.
- Persistence & Privilege
- okalways is false and there are no config paths or requests to modify other skills or system-wide settings. The skill may run git commit if the user approves (or the agent is allowed to act autonomously), which is expected capability for this type of tool.