conventional-commits — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited conventional-commits (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A structured commit history that humans skim and tools parse.
Conventional Commits 1.0 gives every commit a machine-readable prefix so changelogs and version bumps can be generated automatically.
<type>[optional scope][!]: <subject>
[optional body]
[optional footer(s)]Example:
feat(auth): add passkey login
Adds WebAuthn registration and assertion flows behind a feature flag.
Closes #142| Type | Use for | Version impact |
|---|---|---|
feat | A new feature | MINOR |
fix | A bug fix | PATCH |
docs | Docs only | — |
refactor | Code change, no behavior change | — |
perf | Performance improvement | PATCH |
test | Adding / fixing tests | — |
build | Build system or dependencies | — |
ci | CI configuration | — |
chore | Maintenance, no src/test change | — |
revert | Reverts a previous commit | — |
style | Formatting / whitespace only | — |
fix(parser):, feat(api):.Keep it a short noun; stay consistent across the repo.
(It should complete: "If applied, this commit will _add passkey login_".)
Two equivalent signals — use one or both:
feat(api)!: drop support for v1 tokensand/or a footer (always uppercase, in the footer block):
BREAKING CHANGE: v1 tokens are rejected; clients must migrate to v2.A breaking change triggers a MAJOR bump regardless of type.
BREAKING CHANGE: <description>Closes #123, Refs #98Co-Authored-By: Name <email>Run through this before every commit:
console.log, print, debugger,dd(), commented-out blocks.
TODO / FIXME / XXX you intended tofinish in this change.
.env values, or privateURLs in the diff.
! and/or BREAKING CHANGE: if behavioror API changed incompatibly.
git status / git diff / branch /recent log, then writes a commit message in this exact format (feat, fix, docs, refactor, test, chore). Pass a message as the argument to override the generated one.
feat/fix under "Features"/"Bug Fixes", surface BREAKING CHANGE: footers, and derive the next semantic version (PATCH / MINOR / MAJOR) automatically. Junk subjects produce junk changelogs — the discipline above is what makes the automation work.
| ❌ Bad | ✅ Good |
|---|---|
fixed bug | fix(parser): handle empty input lines |
Update code. | refactor(core): extract token loader |
feat: Added new login and also fixed a typo | feat(auth): add passkey login (typo → separate commit) |
feat: remove v1 API | feat(api)!: remove v1 endpoints + BREAKING CHANGE: footer |
WIP | (don't commit WIP to shared history; squash first) |
One logical change, one well-typed commit. Your future changelog writes itself.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.