commit-assisted-by — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-assisted-by (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Record the assisting agent's involvement in a commit by adding an Assisted-by: <agent-name>/<model-id> git trailer. The <agent-name> identify the specific AI assistant (CLI/harness) and <model-id> is the LLM version that contributed to the commit. This disclosure provides transparency about AI involvement in code changes.
In the command examples below, substitute <agent-name>/<model-id> with your own values before running anything.
When you create a commit in a session, limit the commit subject to 50 characters. Use the imperative mood in the subject line (e.g., "Add support for X" instead of "Added support for X").
If the commit message body is needed to explain what and why, wrap it at 72 characters. Avoid verbose explanations in the body, be as concise as possible while still conveying the necessary information.
Pass --trailer directly on the commit command. This is the clean path and avoids amend noise:
git commit -s -m "Add support for X" --trailer "Assisted-by: <agent-name>/<model-id>"Note that all commits must be signed off with a real human name and email to meet the DCO requirement. Never use your agent's name or a pseudonym in the sign-off or co-author fields.
git commit invocationsSometimes a commit lands on HEAD that you did not run yourself — the user invoked git via a shell escape (e.g. Claude Code's ! git commit ...) or a separate terminal. Your only window is after the fact.
Run the bundled safety-check script before amending. It prints safe, or skip:<reason> if HEAD is already pushed, already trailered, a merge, or has a rebase/cherry-pick/revert/bisect in progress.
Invoke it with the script's full path — resolve scripts/safety-check.sh against the directory this SKILL.md was loaded from, not the current working directory (the two are almost never the same):
<skill-dir>/scripts/safety-check.shOnly when the output is exactly safe, amend:
git commit --amend --no-edit --trailer "Assisted-by: <agent-name>/<model-id>"Follow up with one short line so the user knows the hash moved, e.g. "Amended HEAD to add Assisted-by trailer." If the output starts with skip:, tell the user why the commit was skipped.
Triggered by phrases like "add assisted-by to commits in this branch", "tag the commits on this branch", or "backfill the trailer". This is the only mode that rewrites more than HEAD, and only because the explicit request authorizes it. Never enter this mode on autopilot.
Default to @{u} — it guarantees the range is only unpushed commits, which removes the force-push question entirely. If the branch has no upstream, ask the user for an explicit base ref rather than guessing. If the user names a base themselves ("from the last release tag"), honor it.
git log --oneline <base>..HEAD so the user can see the commits that will be rewritten.<base> is anything other than @{u}, run git rev-list <base>..@{u} 2>/dev/null. If non-empty, thosecommits are already on the remote — warn the user that after the rebase they will need to force-push to publish the rewrite, and confirm before proceeding.
(destructive), and --rebase-merges with --exec on merges is fragile — not worth the risk without the user's judgment.
The exec short-circuits on commits that already carry the trailer, so the pass is idempotent:
git rebase <base> --exec 'git log -1 --format=%B | git interpret-trailers --parse | grep -qi "^Assisted-by:" || git commit --amend --no-edit --trailer "Assisted-by: <agent-name>/<model-id>"'Afterwards, report how many commits were tagged vs skipped. If the branch was already pushed, tell the user they will need to run git push --force-with-lease themselves to publish the rewrite.
If the rebase hits a conflict, do not try to resolve it. Surface the conflict to the user and let them choose --continue vs --abort.
git push yourself in any mode, even after a rebase. Publishing rewritten history is the user's call —surface the state and let them decide.
Co-authored-by: — AI assistants are not GitHub users and the co-author convention is reserved forhuman collaborators. Assisted-by: is the correct semantic.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.