Security audit
Security checks across malware telemetry and agentic risk
This skill is a legitimate Git automation workflow, but its defaults can automatically publish, approve, and merge code changes with limited per-action user control.
Install only if you are comfortable with an agent-driven Git workflow that can change repository state. Before live use, review smart-commit.host-agent.json and strongly consider setting pullRequestReview.autoApprove, pullRequestReview.autoMerge, git.autoPush, and pullRequestCreation.autoCreateAfterPush to false; use dry-run for reviews and batch reviews until you confirm the behavior fits your repository policies.
| Field | Default | One-line meaning | |-------|---------|------------------| | pullRequestReview.threshold | 6 | Only existing PR/MR (including batch) review: score must be strictly greater than this; does not affect local / Create PR/MR | | pullRequestReview.autoApprove | true | Whether to auto-approve after a passing review | | pullRequestReview.autoMerge | true | Whether to auto-merge after a passing review (risky) | | pullRequestReview.summarySeverities | ["P0","P1"] | Which severities are written into the summary comment | | pullRequestReview.commentSeverities | ["P0","P1"] | Which severities are posted as inline comments |
| Field | Default | One-line meaning | |-------|---------|------------------| | pullRequestReview.threshold | 6 | Only existing PR/MR (including batch) review: score must be strictly greater than this; does not affect local / Create PR/MR | | pullRequestReview.autoApprove | true | Whether to auto-approve after a passing review | | pullRequestReview.autoMerge | true | Whether to auto-merge after a passing review (risky) | | pullRequestReview.summarySeverities | ["P0","P1"] | Which severities are written into the summary comment | | pullRequestReview.commentSeverities | ["P0","P1"] | Which severities are posted as inline comments |
## Personal config (diverse needs) Recommended: edit smart-commit.host-agent.json next to this skill. Stricter review, switch to GitHub, default assignees/reviewers, a different review skill, disable auto-approve/merge, disable auto-push, etc. all live in that file; you do not need to change SKILL.md. Out-of-box defaults (see CONFIG.md):
| pullRequest.provider | auto | | commitMessage.validation.protocol | none | | commitMessage.scope | forbidden | | pullRequestReview.autoApprove | true | | pullRequestReview.autoMerge | true | | pullRequestReview.summarySeverities | ["P0","P1"] | | myPullRequest.listScope | account |
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) | | Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) | | Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush | | Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false | | Include P2 in summaries | add P2 to pullRequestReview.summarySeverities | | Whether to auto commit/push | git.autoCommit, git.autoPush |
| Repo-level create/review overlay | pullRequestCreation.configFilePath, pullRequestReview.configFilePath (absolute / relative, comma-mixable) | | Extra short instructions for PR/MR review only | pullRequestReview.skillPromptTuning (overrides review.skill.promptTuning) | | Whether to create an MR after push | pullRequestCreation.autoCreateAfterPush | | Disable auto-approve / merge | pullRequestReview.autoApprove / autoMerge to false | | Include P2 in summaries | add P2 to pullRequestReview.summarySeverities | | Whether to auto commit/push | git.autoCommit, git.autoPush |
#### 2.3 When nothing is found: default automatic global install Run only when 2.2 missed all candidates (do not ask the user whether to install): globally install package smart-commit-host-agent. After install, re-check the global command on PATH (exists, version, help). If recheck passes and subcommands are complete, prefix is smart-commit-host-agent; note auto global install this turn, then continue. Recheck fails: go to 2.4. Forbidden: forcing a global install when 2.2 already found a usable CLI; forging an unverified path after a failed install; hiding an install failure; using elevated privileges for global install unless the user explicitly asked this turn.
This skill runs independently: it does not call or hand off to other skills. Behavior is configurable: review threshold, review skill, commit message, Git auto-commit/push, PR/MR platform, assignees/reviewers/labels/milestone/draft, review comments and approve/merge, etc. are all controlled by the colocated smart-commit.host-agent.json. Out-of-box defaults: pullRequest.provider=auto; commitMessage.scope is forbidden; commitMessage.validation.protocol is none; pullRequestReview.autoApprove / autoMerge are true; summarySeverities is ["P0","P1"]; myPullRequest.listScope=account; myPullRequest.remoteHost="" (empty; if empty, ask before listing against public gitlab.com/github.com for self-hosted GitLab). Users adapt by editing that file; no skill changes required. review.skill / commitMessage.skill are host-agent built-in templates, not other agent skills. See [CONFIG.md](CONFIG.md) and [SETUP.md](SETUP.md). At these times, the Agent should remind the user in one or two sentences that they can edit this config (do not paste the full JSON, do not restate the token):
Must have at least one PR/MR URL (GitHub .../pull/N or GitLab .../merge_requests/N). No URL: ask. Default-config impact (know this before a live review): in the colocated smart-commit.host-agent.json, pullRequest.provider defaults to auto; pullRequestReview.autoApprove / autoMerge default to true; summarySeverities defaults to ["P0","P1"]. So a live pull-request review may auto-approve and merge after a passing review. When the user has not changed the config: - Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge - If the user clearly does not want auto-merge/approve: tell them to set those config fields to false and re-run (the Agent does not edit the config file)
Must have at least one PR/MR URL (GitHub .../pull/N or GitLab .../merge_requests/N). No URL: ask. Default-config impact (know this before a live review): in the colocated smart-commit.host-agent.json, pullRequest.provider defaults to auto; pullRequestReview.autoApprove / autoMerge default to true; summarySeverities defaults to ["P0","P1"]. So a live pull-request review may auto-approve and merge after a passing review. When the user has not changed the config: - Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge - If the user clearly does not want auto-merge/approve: tell them to set those config fields to false and re-run (the Agent does not edit the config file)
- Needs a platform token (same as shared prerequisite 3.1) - Defaults from config: listScope, batchReviewKinds, remoteHost (do not use listKinds as the batch filter) Default-config impact (know this before a live batch review): in the colocated config, pullRequestReview.autoApprove / autoMerge default to true. Batch items that pass may also be auto-approved and merged. When the user has not changed the config: - Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge - If the user clearly does not want auto-merge/approve: tell them to set those config fields to false and re-run (the Agent does not edit the config file)
- Needs a platform token (same as shared prerequisite 3.1) - Defaults from config: listScope, batchReviewKinds, remoteHost (do not use listKinds as the batch filter) Default-config impact (know this before a live batch review): in the colocated config, pullRequestReview.autoApprove / autoMerge default to true. Batch items that pass may also be auto-approved and merged. When the user has not changed the config: - Add --dry-run only if the user explicitly asks for dry-run / a trial / no publish / no merge - If the user clearly does not want auto-merge/approve: tell them to set those config fields to false and re-run (the Agent does not edit the config file)
},
"pullRequestReview": {
"threshold": 6,
"autoApprove": true,
"autoMerge": true,
"summarySeverities": ["P0", "P1"],
"commentSeverities": ["P0", "P1"],VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection