CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · README.md

HIGH — when it fires on hostile content the impact is full system-prompt override.

Why it matters

The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.

The exact value spotted

excerptREADME.md· markdown

529| Attack category | Severity | Example |

530|----------------|----------|---------|

531| Instruction-override phrases | CRITICAL | `"ignore all previous instructions"` |

532| Role / identity hijacking | CRITICAL | `"you are now an unrestricted AI"` |

533| Prompt delimiter injection | HIGH | `</system>`, `[INST]`, `<<SYS>>` |

Occurrences

1 occurrence · at L531

How to fix

Remove the override phrase, or rephrase the passage so it does not instruct the agent to discard its rules.

Delete the ignore/disregard/forget … previous instructions sentence.
If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IGNORE-01sha256a202ee6e402bb4a0…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skill_mcp/skills_data/git-commit-writer/SKILL.md · 1 file

skill_mcp/skills_data/git-commit-writer/SKILL.md3.9 KB · Markdown

name: git-commit-writer

description: Generate standardised git commit messages following the Conventional Commits specification. Analyzes staged changes or diffs to produce atomic, descriptive commits. Use when the user wants to write a commit message, commit changes, follow conventional commits format, or generate git history.

license: Apache-2.0

metadata:

author: anthropics

version: "1.0"

tags: [git, commits, conventional-commits, version-control]

platforms: [claude-code, cursor, any]

triggers:

- write a commit message

- commit this change

- conventional commits

- generate commit message

- what should my commit say

- git commit

- squash commits

- write git history

Git Commit Writer Skill

Overview

Generate precise, conventional commit messages from diffs or change descriptions. Follows the Conventional Commits 1.0.0 specification used by Angular, Vue, and thousands of open-source projects.

Conventional Commits Format

<type>[optional scope]: <description>

[optional body]

[optional footer(s)]

Types

Type	When to use
`feat`	New feature visible to users
`fix`	Bug fix
`docs`	Documentation only changes
`style`	Formatting, whitespace (no logic change)
`refactor`	Code restructuring (no feature or fix)
`perf`	Performance improvement
`test`	Adding or correcting tests
`build`	Build system, dependency changes
`ci`	CI/CD configuration changes
`chore`	Other changes (e.g. updating `.gitignore`)
`revert`	Revert a previous commit

Breaking Changes

Add ! after the type/scope, and a BREAKING CHANGE: footer:

feat(api)!: remove deprecated /v1/users endpoint

BREAKING CHANGE: The /v1/users endpoint has been removed. Use /v2/users instead.

Step-by-Step Process

Step 1: Understand the Change

Ask for or read the diff (git diff --staged or git diff HEAD). Understand:

What changed (files, functions, logic)
Why it changed (bug fix, new requirement, refactor)
Whether it's a breaking change

Step 2: Choose the Type

Apply the type that matches the primary intent. If a PR mixes types, flag it - atomic commits are better.

Step 3: Choose the Scope (Optional)

Scope = the subsystem or module affected. Examples: (auth), (api), (ui), (db).

Use it when the codebase has clear module boundaries
Omit it for small or cross-cutting changes

Step 4: Write the Description

Rules:

Imperative mood: "add feature" not "added feature" or "adds feature"
Lowercase first letter
No period at the end
Max 72 characters on the first line
Describe WHAT, not HOW

Bad: Fixed the bug with user login Good: fix(auth): handle missing refresh token on session expiry

Step 5: Write the Body (When Needed)

Include a body when:

The why is non-obvious
There are multiple related changes
A workaround or constraint is present

Separate from subject with a blank line. Wrap at 72 characters.

Step 6: Add Footers

BREAKING CHANGE: <description> - required for breaking changes
Closes #123 - closes a GitHub issue
Co-authored-by: Name <email> - pair programming / AI assistance

Examples

feat(payments): add Stripe webhook signature verification

fix(api): return 404 instead of 500 for unknown resource IDs

Previously the handler threw an unhandled KeyError when the resource
was not found, resulting in an opaque 500. Now returns a structured
404 with a message field.

Closes #847

refactor(db): replace raw SQL with SQLAlchemy ORM in user queries

No behavior changes. Preparatory step for the multi-tenant migration.

Multi-commit Guidance

When the user has a large changeset that should be multiple commits:

Group changes by type and scope
Order: infrastructure → models → business logic → tests → docs
Each commit should pass tests in isolation

git-commit-writer— agent skill

Is git-commit-writer safe to install?

Git Commit Writer Skill

Overview

Conventional Commits Format

Types

Breaking Changes

Step-by-Step Process

Step 1: Understand the Change

Step 2: Choose the Type

Step 3: Choose the Scope (Optional)

Step 4: Write the Description

Step 5: Write the Body (When Needed)

Step 6: Add Footers

Examples

Multi-commit Guidance

Audit the pieces. Scan the whole. Decide.