workflow-git-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-git-commit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate clear, meaningful commit messages following best practices.
<type>(<scope>): <subject>
<body>
<footer>| Type | When to Use |
|---|---|
feat | New feature |
fix | Bug fix |
docs | Documentation only |
style | Formatting, no code change |
refactor | Code change that neither fixes nor adds |
perf | Performance improvement |
test | Adding/updating tests |
chore | Build, tooling, deps |
ci | CI/CD changes |
Component or area affected:
feat(auth): add OAuth2 support
fix(api): handle rate limit errors
docs(readme): update installation steps# View staged changes
git diff --staged
# View changed files
git statusRules:
Good:
feat(cart): add quantity selector to items
fix(auth): prevent session timeout during checkout
refactor(utils): extract date formatting logicBad:
Fixed the bug. # Vague, past tense
feat(cart): Added new feature # Past tense, vague
Update stuff # No type, vagueWhen to include:
Format:
feat(payments): add Stripe webhook handler
Implement webhook endpoint to process payment events.
Handles succeeded, failed, and refunded events.
Closes #123feat(dashboard): add dark mode togglefix(api): handle null response from external service
The third-party API occasionally returns null instead of
an empty array. Add null check to prevent TypeError.
Fixes #456refactor(hooks): extract useDebounce from search component
Move debounce logic to reusable hook for consistency
across search inputs throughout the app.feat(api)!: change response format for user endpoint
BREAKING CHANGE: The /api/users endpoint now returns
{ data: [...], meta: {...} } instead of a plain array.
Migration: Update clients to access users via response.dataIf you need to describe multiple things, consider splitting into separate commits:
# Instead of:
"fix(auth): fix login and add logout button and update styles"
# Do:
git commit -m "fix(auth): handle expired token error"
git commit -m "feat(auth): add logout button to header"
git commit -m "style(auth): update login form spacing"# Stage and commit
git add .
git commit -m "feat(scope): description"
# Amend last commit message
git commit --amend -m "new message"
# Interactive staging
git add -p
# View commit history
git log --oneline -10Create ~/.gitmessage:
# <type>(<scope>): <subject>
# |<---- Using a Maximum Of 50 Characters ---->|
# Explain why this change is being made
# |<---- Try To Limit Each Line to a Maximum Of 72 Characters ---->|
# Provide links or keys to any relevant tickets, articles or other resources
# Example: Fixes #23
# --- COMMIT END ---
# Type can be:
# feat (new feature)
# fix (bug fix)
# refactor (refactoring code)
# style (formatting, missing semi colons, etc)
# docs (changes to documentation)
# test (adding or refactoring tests)
# chore (updating grunt tasks etc)
# --------------------Set as default:
git config --global commit.template ~/.gitmessage~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.