git-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited git-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a set of changes into a clean, conventional commit (and push, if asked). Work from the actual repo state and the project's own rules, never from assumptions about what the change "probably" is.
Co-Authored-By: trailer. Never mention Claude, Claude Code, or any AI in a commit message, body, or branch name. The message must read as if a human engineer wrote it.node_modules, build output, .env/secrets/keys, lockfile churn you didn't intend, or generated artifacts (plans, reports, analyses, summaries, scratch notes). Source-code changes only; anything else needs an explicit ask.Build a complete picture before touching anything. Run these (read-only) and actually read the output:
git status: what's modified, staged, untracked.git diff (unstaged) and git diff --staged (staged): the actual changes, line by line.git branch --show-current and git branch -a: where you are and what exists.git log --oneline -15: the repo's established message and scope style; match it.git status --ignored: confirm nothing sensitive or generated is sneaking in, and that .gitignore already covers node_modules, build dirs, env files, etc.If something is untracked that should be ignored (secrets, env, build output, dependencies), flag it and suggest a .gitignore entry rather than committing it.
Repos enforce their own conventions; find and obey them before writing anything:
commitlint.config.{js,cjs,mjs,ts}, .commitlintrc*, a commitlint key in package.json, or equivalents in other ecosystems. Read the allowed types/scopes and subject limits and conform exactly..pre-commit-config.yaml, .husky/, .git/hooks/, lefthook.yml, or framework equivalents. The commit must pass these. Don't bypass with --no-verify; if a hook fails, fix the cause (formatting, lint, tests) and report it.CONTRIBUTING* and any PR/commit template for additional expectations.When the repo's rules conflict with the defaults below, the repo wins.
git add path/to/file), reviewing each. Use git add -p to split mixed files into logical hunks.If the work doesn't belong on the current branch (e.g. you're on main/master or a release branch), create one off the up-to-date main branch. Naming convention:
| Prefix | When to use |
|---|---|
feat/ | New feature |
fix/ | Bug fix |
chore/ | Maintenance, dependencies, config |
docs/ | Documentation only |
refactor/ | Code change that isn't a fix or feature |
test/ | Adding or updating tests |
Use short, kebab-case descriptions: feat/task-dependency-api, fix/refresh-token-expiry, docs/update-contributing, chore/upgrade-prisma. Honor any stricter rule found in Step 2.
Subject line: type(scope): summary
feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert (or whatever the repo's commitlint permits).feat(auth): ….!: feat(api)!: drop v1 token endpoint.*Body: explain why, not what.* The diff already shows what changed; the body exists for future code archaeology. Wrap at ~72 columns. Cover, in prose:
Footer
fix(auth): handle token expiry (#42)) and/or as footers: Closes #42, Refs JIRA-1234, ClickUp: CU-abc.BREAKING CHANGE: <description> footer.Template (adapt, don't pad with empty sections):
type(scope): concise imperative subject (#123)
Why: the motivation or constraint that prompted this change, and the
problem it solves, written for someone reading `git blame` in a year.
[Only if non-obvious] What: the key technical move that makes it work.
Closes #123-m flags or a heredoc; never embed an AI/co-author trailer.--no-verify.git push -u origin <branch>).Report what landed: the commit hash/subject and, if pushed, where.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.