Security audit

git-commit-ai

Security checks across malware telemetry and agentic risk

Overview

This is a coherent commit-message helper, but users should remember that staged diffs may be placed into AI context and that the optional hook changes repository behavior.

Before using this skill, review `git diff --cached` for secrets, proprietary code, personal data, or internal URLs because staged diff content may be included in AI analysis. Only run `--install` if you want a persistent repository hook, and avoid `--force` unless you have checked any existing `prepare-commit-msg` hook and are comfortable replacing it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill’s primary stated purpose is commit-message generation, but it also persists changes to the repository by installing a Git hook. That is a materially different side effect from the advertised function and can surprise users or be abused to alter developer workflow, especially because it writes into .git/hooks and can replace existing behavior when forced.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The hook content is framed as a harmless reminder, but the install flow can overwrite an existing prepare-commit-msg hook when --force is used, and even non-force mode creates backups rather than preventing risky modification. Replacing hooks can disable security checks, policy enforcement, or other repository automation, so the mismatch between description and effect is security-relevant.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly states it uses Claude AI to analyze the staged git diff, but it does not warn users that staged code and comments may be transmitted to an external AI service. This creates a real data exposure risk because staged diffs often contain proprietary code, secrets, internal URLs, or personal data, and users may invoke the skill without understanding that this content leaves the local environment.

Natural-Language Policy Violations

Low

Confidence: 74% confidence
Finding: Automatic language selection based on code comments means the tool inspects comment text and derives behavior from potentially sensitive repository content without explicit consent. While lower severity than direct exfiltration, this increases privacy concerns and can surprise users because comments may contain internal business context, names, or incident details that influence processing.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:53