Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

git-commit-ai

v1.0.0

根据暂存区 git diff 自动生成符合 Angular 规范的详细中英文 commit message,支持语言自动检测和参数指定。

0· 331·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zenoleee/git-commit-ai.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "git-commit-ai" (zenoleee/git-commit-ai) from ClawHub.
Skill page: https://clawhub.ai/zenoleee/git-commit-ai
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install git-commit-ai

ClawHub CLI

Package manager switcher

npx clawhub@latest install git-commit-ai
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the implementation: the code reads staged git diff, extracts context, supports language selection, and can install a prepare-commit-msg hook. There are no unrelated required binaries, env vars, or external installers requested.
Instruction Scope
SKILL.md and index.js instruct the agent to read git staged diffs, optional repo config (package.json or .gitcommitairc), and to optionally install a git hook — all within expected scope. SKILL.md and the code include explicit system-prompt style instructions (a system prompt for the AI to generate commit messages); a static scan flagged a 'system-prompt-override' pattern. That is expected for a tool that crafts prompts for a model, but be aware platform-level prompt handling may treat skill prompts differently.
Install Mechanism
No install spec that downloads arbitrary code. The skill is instruction+code only; it writes a local git hook under .git/hooks when run with --install, which is expected for this functionality. There are no external URL downloads or archive extractions.
Credentials
The skill requests no environment variables or credentials. It mentions using 'Claude AI' in docs but does not require external API keys in the code; presumably it relies on the host/agent model invocation capabilities. No unrelated secrets are requested.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills or system-wide settings. The only persistent change it can make is installing a prepare-commit-msg hook in the repository (done only when user runs --install, and the code backs up existing hooks unless --force is used).
Scan Findings in Context
[system-prompt-override] expected: The SKILL.md and index.js include system-prompt style instructions for the AI (e.g., '你是 Git commit message 生成助手...'). This is expected because the skill builds prompts for model generation; however static detectors flag this pattern because it can be used for prompt injection if misused.
Assessment
This skill appears to do what it says: it reads your staged git diff, generates an Angular-style commit message, and can optionally install a local prepare-commit-msg hook. Before installing or running: 1) Review the generated hook content (the skill backs up existing hooks unless you use --force). 2) Confirm you are comfortable with the skill reading files in your repository (it reads package.json and optional config files in the repo root). 3) Note the SKILL.md includes explicit prompt instructions for the model — ensure your environment’s model invocation and policy enforcement are acceptable, since prompt text from skills can affect model outputs. 4) No API keys are requested by the skill; if a future version asks for external credentials (Claude API keys, etc.), treat that as a separate risk and verify why they are needed. To uninstall the hook, remove .git/hooks/prepare-commit-msg or restore the backup the tool created.
index.js:53
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97596s0agkgabcq2jhhf0a2k582vrhv
331downloads
0stars
1versions
Updated 18h ago
v1.0.0
MIT-0

git-commit-ai

根据 git diff 自动生成符合规范的 commit message

功能说明

这个 skill 会分析当前 Git 仓库的暂存改动,使用 AI 生成详细、准确的 commit message。

主要特性:

  • 📝 从 diff 中提取具体信息(函数名、组件名、注释等)
  • 🌐 智能语言检测(根据代码注释自动选择中文/英文)
  • ✅ 符合 Angular commit 规范
  • 🎯 详细的描述,不再只说"新增功能"

使用方法

基本使用

/git-commit-ai

带参数使用

# 强制使用中文
/git-commit-ai --language zh

# 强制使用英文
/git-commit-ai --language en

# 自动检测(默认)
/git-commit-ai --language auto

参数说明

参数说明默认值
--languagecommit message 语言 (auto/zh/en)auto

使用示例

示例 1: 中文代码

Git Diff:

+// 添加用户登录验证
+export function validateLogin(email, password) {
+  // 验证邮箱格式
+  if (!email.includes('@')) {
+    throw new Error('邮箱格式不正确');
+  }
+}

生成结果:

feat(auth): 添加用户登录验证功能,支持邮箱格式校验

示例 2: 英文代码

Git Diff:

+// Add user login validation
+export function validateLogin(email, password) {
+  // Validate email format
+  if (!email.includes('@')) {
+    throw new Error('Invalid email format');
+  }
+}

生成结果:

feat(auth): add user login validation with email format check

工作原理

  1. 获取 Git diff - 读取暂存区的改动
  2. 分析变更内容 - 识别变更类型、提取关键信息
  3. 智能语言检测 - 根据代码注释语言自动选择
  4. 生成 message - 使用 AI 生成详细的 commit message

分析能力

从 diff 中提取的信息

  • ✅ 函数名和组件名
  • ✅ 代码注释(用于语言检测和意图理解)
  • ✅ 文件路径(用于确定 scope)
  • ✅ API 端点和路由
  • ✅ 具体的改动内容

支持的 commit 类型

  • feat: 新功能
  • fix: Bug 修复
  • docs: 文档变更
  • style: 代码格式
  • refactor: 重构
  • perf: 性能优化
  • test: 测试
  • chore: 构建/工具

输出格式

生成的 commit message 符合 Angular commit 规范:

<type>(<scope>): <description>

示例:

  • feat(auth): 添加用户登录验证功能
  • fix(api): 修复 getUser 接口的空指针异常
  • refactor(utils): 提取邮箱验证逻辑到独立函数

注意事项

  1. 需要有暂存的改动 - 运行前请先 git add
  2. 自动语言检测 - 根据代码注释智能选择语言
  3. 详细描述 - 会从代码中提取具体信息,不会只说"新增功能"

常见问题

Q: 为什么没有暂存的改动时会报错?

A: 工具需要分析 git diff --cached 的内容,所以需要先 git add 暂存改动。

Q: 如何强制使用特定语言?

A: 使用 --language zh--language en 参数。

Q: 生成的 message 不够准确怎么办?

A: 可以尝试添加更多代码注释,帮助 AI 理解改动的意图。

技术实现

  • 使用 Git 命令获取 diff
  • 通过 Claude AI 分析内容
  • 智能提取代码信息
  • 生成符合规范的 message

相关资源

更新日志

v1.0.0

  • ✅ 初始版本
  • ✅ 支持中英文自动检测
  • ✅ 详细的 diff 分析
  • ✅ 符合 Angular commit 规范

Comments

Loading comments...