commit-msg — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-msg (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a well-structured commit message based on the current staged changes.
git diff --stagedIf there are no staged changes, tell the user and stop. Suggest they run git add <files> first.
Also check the language used in recent commits to decide whether the message should be in Traditional Chinese or English:
git log --oneline -5Use Traditional Chinese if recent commits are in Chinese, otherwise use English.
Look at what files changed and what the diff shows. Ask yourself:
Choose exactly one type based on the primary intent of the change:
| Type | When to use |
|---|---|
feat | New feature for the user (not a build-script feature) |
fix | Bug fix for the user (not a build-script fix) |
docs | Documentation only — no code logic changed |
style | Formatting, whitespace, semicolons — zero semantic change |
refactor | Code restructured without fixing a bug or adding a feature |
chore | Maintenance, dependency updates, config — no production code touched |
perf | Performance improvement |
revert | Reverts a previous commit |
test | Adding or fixing tests — no production code change |
build | Build system or external dependency changes (e.g., webpack, npm scripts) |
ci | CI/CD configuration (e.g., GitHub Actions, workflows) |
When the diff spans multiple types, pick the one that best describes the primary intent.
Title format:
type: short description (imperative mood, under 72 chars)Examples:
feat: 新增使用者登入功能fix: 修正 MongoDB 連線逾時問題refactor: extract database connection logic into helperBody (bullet points):
List specific changes and their reasons below the title, each starting with -. Focus on the why and what, not just restating the file names.
feat: 新增跨容器通訊範例
- 新增 Node.js app 容器，透過 Docker 自訂網路連接 MongoDB
- 使用 mongoose 連線，並修正 useUnifiedTopology 設定以符合新版 API
- 在 docker-compose.yml 定義 app-network 讓容器間可互相解析主機名稱Display the commit message in a code block so the user can copy it easily:
type: title here
Then ask: "要直接用這個 commit message 提交嗎？" (or in English if the message is in English: "Would you like me to apply this commit message now?")
If the user confirms, run:
git commit -m "$(cat <<'EOF'
type: title here
- detail one
- detail two
- detail three
EOF
)"If the user wants edits, apply them first before committing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.