Is speckit-git-commit safe to install?

SaferSkills independently audited speckit-git-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.agents/skills/speckit-git-commit/SKILL.md · 1 file

.agents/skills/speckit-git-commit/SKILL.md1.9 KB · Markdown

name: speckit-git-commit

description: Auto-commit changes after a Spec Kit command completes

compatibility: Requires spec-kit project structure with .specify/ directory

metadata:

author: github-spec-kit

source: git:commands/speckit.git.commit.md

Auto-Commit Changes

Automatically stage and commit all changes after a Spec Kit command completes.

Behavior

This command is invoked as a hook after (or before) core commands. It:

Determines the event name from the hook context (e.g., if invoked as an after_specify hook, the event is after_specify; if before_plan, the event is before_plan)
Checks .specify/extensions/git/git-config.yml for the auto_commit section
Looks up the specific event key to see if auto-commit is enabled
Falls back to auto_commit.default if no event-specific key exists
Uses the per-command message if configured, otherwise a default message
If enabled and there are uncommitted changes, runs git add . + git commit

Execution

Determine the event name from the hook that triggered this command, then run the script:

Bash: .specify/extensions/git/scripts/bash/auto-commit.sh <event_name>
PowerShell: .specify/extensions/git/scripts/powershell/auto-commit.ps1 <event_name>

Replace <event_name> with the actual hook event (e.g., after_specify, before_plan, after_implement).

Configuration

In .specify/extensions/git/git-config.yml:

auto_commit:
  default: false          # Global toggle — set true to enable for all commands
  after_specify:
    enabled: true          # Override per-command
    message: "[Spec Kit] Add specification"
  after_plan:
    enabled: false
    message: "[Spec Kit] Add implementation plan"

Graceful Degradation

If Git is not available or the current directory is not a repository: skips with a warning
If no config file exists: skips (disabled by default)
If no changes to commit: skips with a message

speckit-git-commit— agent skill

Is speckit-git-commit safe to install?

Auto-Commit Changes

Behavior

Execution

Configuration

Graceful Degradation

Audit the pieces. Scan the whole. Decide.