code-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create coherent, reviewable commits that follow the Conventional Commits specification. Message syntax matters, but the selected changes must tell one clear story too.
Every generated commit has a title and body:
<type>(<scope>): <imperative title>
<1-5 lines describing the change and, when useful, its reason or effect>Use a lowercase scope that identifies the affected component. The title is concise, imperative, lowercase, and has no trailing period. The body is concrete: explain the behavior, motivation, or important implementation decision rather than restating the title.
| Type | Use for |
|---|---|
feat | New user-facing capability |
fix | Corrected behavior |
docs | Documentation only |
style | Formatting only |
refactor | Restructuring without behavior change |
test | Tests only |
chore | Maintenance or tooling |
perf | Performance improvement |
ci | Continuous integration configuration |
build | Build system or dependencies |
revert | Reverting a prior commit |
Breaking changes may use ! after the type or scope, a BREAKING CHANGE: footer, or both. Include issue footers such as Closes #123 only when the issue is known.
When the user asks to commit, first inspect the complete worktree:
git status --short.git diff --cached and git diff so pre-staged work is not mistaken for the entire change.git ls-files --others --exclude-standard and inspect relevant ones.git log --oneline -10 to match established scopes and wording.Default to one commit containing all intended, related changes. Look for an obvious file-level split only when changes are independent and each group can stand alone.
Keep these together:
Do not invent a split for adjacent work, use hunk-level staging, or force the user to reorganize a coherent change. If an obvious split exists, propose each commit with its files and full message, then ask once for approval. If not, propose one commit.
Before making any write, show:
Ask for approval unless the user explicitly authorizes committing immediately. After approval, stage only the files for the approved commit with git add -- <paths> and inspect git diff --cached --name-status and git diff --cached again. If the staged snapshot contains any unapproved file, stop and ask how to handle it. Then commit with the proposed title and body. Do not amend, rebase, push, or include unapproved files.
Repository commit hooks are the final message validation when configured. Never bypass a failing hook. Report the commit hash on success; report the error and leave changes intact on failure.
When the user asks to validate a message, check:
type(scope): imperative title.! and a BREAKING CHANGE: footer.Return specific corrections and a revised message. When the repository configures commitlint, use it as the authoritative validation rule.
If the user wants to create a PR after committing, invoke the code-pull-request skill. It detects the platform (GitHub/GitLab), finds a template, generates the body, and opens the PR via gh or glab.
| Input | Action |
|---|---|
| User says "commit" or "git commit" | Inspect the worktree, propose coherent commit(s), then commit after approval |
| User says "validate commit" | Check the commit message format |
| User pastes commit message | Validate the provided message |
Input: "I fixed the login bug" Output:
fix(auth): resolve login timeout issue
Correct token expiry calculation so active users are not logged out after five minutes.Input: "I added a new API endpoint for users" Output:
feat(api): add user profile endpoint
Expose name, email, and avatar URL from `GET /users/:id`.
Closes #89Input: "I changed the auth API, this breaks old clients" Output:
feat(auth)!: change token validation endpoint
Require a Bearer token on `/auth/verify` instead of a query parameter.
BREAKING CHANGE: Clients must update to send
Authorization header with Bearer token.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.