commit-message — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-message (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft a Conventional Commit message from staged changes.
commit-message.Skip the notice when the user asked for the skill by name or slash command; spelling and spacing need not match. A phrase from this skill's own trigger list is not a name — naming the work is not naming the skill.
--cached / staged SCM state) as input, unless the user invokes the Context Override or Commit Train path.AI-assistant: <AGENT> footer.| Situation | Path |
|---|---|
| Staged changes exist and land as one commit | Workflow |
| The user points at prior conversation work or a working document instead of the diff ("use what we just did", "skip the diff") | Context Override |
| The work is meant to land as several commits | Commit Train |
Body Discipline governs the body on all three.
These rules govern body content. Apply them at draft time (step 8) and re-check before output (step 10).
Your reader meets this commit in two phases: Scan mode — they see the subject in git log, git blame, or a bisect and decide whether to open it. Read mode — once opened, they read the diff and the durable artifacts around it: the specs, design docs, ADRs, README, changelog, and docstrings present in the repo at this commit.
The subject carries scan mode — name the area and effect concretely enough to distinguish from neighbors.
The body exists only when read mode leaves a question unanswered. If no gap exists, ship subject-only — most commits. Conversation weight is not reader weight: what felt load-bearing in the dialogue is rarely what the diff fails to convey.
Triggers 2 through 6 fire only where read mode leaves the answer missing. A docstring, an error message, or a comment carried in the diff that already states the why closes the gap, and no body line survives on top of it. Orientation is the exception: it answers a reconstruction burden spread across files, which the diff's own prose does not relieve.
A body line is warranted only when it fires one of these 6 triggers:
Name what it does and what it operates on; naming the knobs without saying what the capability does is inventory rather than orientation. Does not fire for internal refactors, for single-file changes, or where the subject already conveys the shape.
A bare list of values is inventory; the trigger fires only where the body supplies a why the diff cannot.
A trigger licenses a line; it does not oblige one. Where no trigger fires, ship subject-only, as most commits should.
Otherwise the body gets one short paragraph per capability the change introduces, plus at most one more carrying everything the other five triggers earned between them. A short paragraph runs one to four wrapped lines, and most bodies come to one or two.
Count capabilities, not named surfaces: a command's own flags and subcommands belong to it, and surfaces that only make sense together are one capability. Where orientation still runs long, compress it to the capability level first; if it will not compress because the capabilities are unrelated, the commit is doing several things and wants splitting (see Commit Train).
When the other triggers overflow their single paragraph, the surplus rationale belongs in a design doc or spec. Keep whichever line a reader is most likely to be hurt by not knowing, and drop the rest.
Where the repo keeps specs, design docs, or ADRs, those artifacts are the versioned home for contracts and rationale, and the commit body is not. Route only to what an artifact carries now, in this change or already in the repo; a doc that has yet to be written is not a home.
A body copy is unversioned and goes stale independently of the artifact it duplicates.
Reserve the body for a hazard with no home in those artifacts.
Announcing that this change fires an obligation the spec defines is not a restatement of it. The spec states the rule; the commit reports that it just fired, and which value it landed on.
This does not suppress orientation. Shape is what a reader invokes and what comes back; contract is the terms that answer holds to, including its normative guarantees, thresholds, exhaustive conditions, and edge cases. Naming the shape orients a reader who has not opened the spec, while reproducing the contract duplicates it. On a borderline line, ask which document a reader would cite to settle a dispute about it — if that document is the spec, let the spec carry it.
For every body line you are about to write, name which of the 6 cold-reader triggers it fires. If you can't name one, don't write the line — it's conversation weight or file inventory, not reader signal. "It feels useful to mention" is not a trigger.
A fired trigger is necessary, not sufficient. Where the answer already lives in a durable artifact or in the diff's own prose, the line still doesn't survive: routing and the Cold-reader test both outrank the trigger that licensed it.
A version or schema bump that consumers pin to fires cross-cutting impact and stays.
If it is not the standard path, follow that path instead of the rest of this workflow.
Prefer workspace root when known; otherwise run git rev-parse --show-toplevel.
git -C <repo-root> diff --cached, or with the harness's SCM tooling where it offers one scoped to an explicit repo root.A large diff can exceed one tool call's output limit, so check what you received against git -C <repo-root> diff --cached --stat and page through the remainder before drafting; a message written from the first page reads complete.
If empty, retry once with explicit repo root; if still empty, inform user and stop.
Identify changed files, behavior impact, logical scope, and likely commit type.
Read recent bodies for the changed paths (git -C <repo-root> log -5 --format='%B' -- <changed paths>) and match the house convention. Calibration governs how much to write and in what shape; it can lower the Budget but never raise it.
Preserve explicit issue refs and constraints from user input.
references/conventional-commit-rules.md.Then draft the message covering only the lines named in step 8, applying those rules.
Revise or drop any failing lines before output.
git commit -F -.Use this path when the user explicitly directs you to draft from prior conversation work or a working document rather than from the staged diff. Body Discipline applies here too — conversation-derived drafts are the highest-risk source for conversation weight.
Do not run git diff or any other SCM inspection.
references/conventional-commit-rules.md.Then draft the message, preserving any explicit issue refs and constraints the user provided.
git commit -F -.Use this path when the work spans several logical commits and is not yet staged. The staged-changes constraint does not apply; each message is drafted from its own group's diff.
git -C <repo-root> diff -- <paths>), applying Body Discipline per message.Budget applies per commit.
Staging and committing remain the user's call.
references/conventional-commit-rules.md - subject/body/footer rules and examples.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.