commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create atomic commits by staging the right files, analyzing the staged diff, composing a commit message, and optionally pushing.
Arguments: $ARGUMENTS
--all commit all changes--staged commit exactly the current index; do not auto-stage or unstage (conflicts with --all)--deep deep analysis with the active session model, breaking changes, concise body--natural force Natural Language Format--push push after commit--close <issue_numbers> append Closes #N trailers for listed issues (comma/space-separated)Pass --natural through to the prepare helper when requested. The helper resolves the message format from the target repository cwd. Never cd into the skill directory.
Run the portable helper from the target repository cwd. Never cd into the skill directory, and never use dynamic ! shell injection.
Resolve <skill-dir> from the loaded SKILL.md path:
bash "<skill-dir>/scripts/prepare-commit.sh" [--all] [--staged] [--natural] [--diff summary|full] -- [session_modified_paths...]Use --diff summary by default. Use --diff full only when the intent is ambiguous or --deep was requested.
The helper performs Git preflight checks, stages --all or the session-modified paths (or, with --staged, leaves the current index untouched), unstages unrelated pre-staged paths, rejects empty staged diffs, and prints the message format, branch, staged name-status, shortstat, and optional full diff. If it fails, stop with its error and a concise suggested fix.
--all:--staged:--all.--git checkout unrelated changes.Read the helper output and produce the commit message in a single pass.
Message format — use the ## message format value from the helper output.
conventional: read references/conventional-prefix-format.md.natural: read references/natural-language-format.md.Read only the selected format reference before composing the message.
Unrelated hunks — ignore pre-existing changes when determining type/scope/description. If unrelated changes are in the same file as session changes, they are included in the commit scope but should not influence the message.
Issue linking — scan the chat transcript for GitHub issue references (e.g. #123, owner/repo#123, issue URLs) that the current changes resolve. For each match, append a Closes #N trailer. Skip issues merely mentioned in passing; include only ones the commit actually closes.
If `--deep`:
If `--close`:
Closes #N line for each issue number providedCloses #N per line in the body/trailergit commit -m "subject" (add -m "body" only if body is non-empty)N files changed summary. Nothing else.git commit --no-verify — do not ask. Report the bypass in one line, noting the failure was unrelated to the staged changes. Never bypass hooks for failures caused by the session's own changes; fix those or surface the error instead.--push)git pushgit push -u origin HEAD~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.