Is commit-msg safe to install?

SaferSkills independently audited commit-msg (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/commit-msg/SKILL.md · 1 file

skills/commit-msg/SKILL.md2.1 KB · Markdown

name: commit-msg

description: Analyze staged git changes and generate commit message options with title and body

Commit message guidelines

Each commit message has a title and body, separated by a blank line. Match the existing commit formatting in the repository first; use these defaults where the repo has no clear convention.

Title:

Aim for 50 characters, hard limit of 72 (keeps messages scannable in git log --oneline and avoids truncation)
Use the imperative mood — write as a command, not a description. The title should complete the sentence: "If applied, this commit will ___"
Lead with a strong action verb (e.g., Add, Fix, Refactor, Remove, Update, Replace, Extract, Simplify, Improve)
Capitalize the first word and omit trailing periods

Body:

Explain what changed and why, not how — the diff shows the how
Only describe the final outcome; exclude investigative steps, failed attempts, or debugging detours from the conversation that led to the change
1-3 sentences providing context, motivation, or consequences not evident from the title
Each sentence should add depth or highlight a distinct aspect of the change
Wrap lines at 72 characters for readability in terminals and git tools

Voice: Read and follow the voice guidelines in /arriba:code-voice

Workflow

Get the staged diff for analysis:

   git diff --cached

Check previous commit message format in the repository:

   git log --oneline -10

Search staged changes for ticket IDs (patterns like PROJ-123, D4T-123, etc.)

Generate 3 distinct commit message options following the format above. Each option should use a different verb and framing — not rephrase the same sentence.

Follow these guidelines:

Match the format used in previous commits in the repository
If a ticket ID was found, include it in the title (typically as a prefix)
Do not add Claude as a co-author in the commit message

Present the options to the user for selection using AskUserQuestion

Create the commit with the selected title and body:

   git commit -m "<title>" -m "<body>"

commit-msg— agent skill

Is commit-msg safe to install?

Commit message guidelines

Workflow

Audit the pieces. Scan the whole. Decide.