commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Commit the current changes using micro commits with conventional commit messages.
Do NOT run any git commands, read any files, or spawn any agents before the mode is selected. The very first action in this skill is always mode selection — nothing else.
Check $ARGUMENTS first:
$ARGUMENTS is i → use Interactive mode$ARGUMENTS is ni → use Non-interactive modeAskUserQuestion to ask the user:Question: "How would you like to commit?"
Options:
The point of this skill is to commit the work we just did together, not whatever else happens to be dirty in the working tree (a half-edited file from before the session, a stray local config tweak, etc.). Always scope to session-touched files first, then explicitly opt extras in.
Do this in the parent conversation before dispatching any background agent — the parent is the only one with the session context needed to know which files were touched.
From the current conversation, list every file path that was modified in this session via:
Edit, Write, NotebookEdit tool callsBash commands that wrote to files (e.g., mv, cp into a tracked path, code generators, npm install for lockfiles, formatters that ran on specific paths)Normalize paths to be relative to the repo root. Call this set SESSION_FILES.
If SESSION_FILES is empty (e.g., the user invoked /commit without any prior edits this session), skip straight to step 3 and treat all dirty files as "extras" requiring explicit confirmation.
Run git status --porcelain to get the full set of dirty paths (DIRTY_FILES: modified, staged, and untracked).
Compute:
IN_SCOPE = SESSION_FILES ∩ DIRTY_FILES — what we'll commitEXTRAS = DIRTY_FILES − SESSION_FILES — pre-existing dirt the session did not touchMISSING = SESSION_FILES − DIRTY_FILES — session-touched files that have no diff (already committed mid-session, or reverted) — just ignore theseIf EXTRAS is non-empty, use AskUserQuestion. Put the actual file list in the question text so the user can see what they're deciding on:
Question text: "Found N file(s) changed outside this session: <path1>, <path2>, … . Include them in the commits?"
Options:
AskUserQuestion with one option per file: include / skip)Update IN_SCOPE based on the answer. If IN_SCOPE ends up empty, tell the user there's nothing to commit and stop.
Pass IN_SCOPE (the explicit file list) into Interactive or Non-interactive mode. From this point on, never use `git add .`, `git add -A`, or `git add -u` — only stage paths from IN_SCOPE.
Run the workflow below (analyze, group, propose, commit, push) but restrict every git diff / git add to paths in IN_SCOPE. When grouping, only consider files in IN_SCOPE.
Spawn a background Agent (use model: "sonnet" and run_in_background: true). The prompt MUST include the explicit IN_SCOPE file list and instruct the agent to operate only on those paths.
Prompt the agent to:
git add . / -A / -u. If git status shows other dirty files, leave them alone.git diff -- <IN_SCOPE>, git diff --cached -- <IN_SCOPE>, git log --oneline -10 for style.IN_SCOPE only) using the grouping heuristics below.-u origin <branch>; if on main/master, do NOT push and mention it in the result.After dispatching the agent, use the Monitor tool on the background agent to stream its progress events (each stdout line arrives as a notification). Surface meaningful milestones — e.g., "staged 3 files", "committed: feat(auth): …", "pushed to origin" — as they happen, without polling or sleeping.
Then inform the user: "Committing N session file(s) in the background — I'll report progress as it commits." Do not block the conversation; continue with other work between monitor notifications.
When the background agent completes, summarize what it committed (and whether it pushed). If Monitor surfaced errors mid-run (failed hook, push rejected, ambiguous group skipped), include those in the summary.
Scope every diff to IN_SCOPE (computed during session-scoping). Run these in parallel:
git status -- <IN_SCOPE> — state of the in-scope filesgit diff -- <IN_SCOPE> — unstaged changesgit diff --cached -- <IN_SCOPE> — already-staged changesgit log --oneline -10 — recent commit style for this repoIf IN_SCOPE is empty, tell the user there's nothing to commit and stop.
Analyze the changes and group files that belong together in a single commit. Each group should represent one logical change.
Grouping heuristics:
For each group, use the AskUserQuestion tool. Put the details in the question text itself so the user can read them clearly:
Question text should include:
Options:
For each approved group, stage only the specific files and commit:
git add <files>
git commit -m "<conventional-commit-message>"For changes that need a longer explanation, use a commit body via heredoc:
git commit -m "$(cat <<'EOF'
feat(auth): add OAuth2 login flow
Adds Google and GitHub OAuth providers. Session tokens are stored
in encrypted cookies with a 24h TTL.
EOF
)"Use a body when the "why" isn't obvious from the title alone — e.g., non-trivial refactors, workarounds, or architectural decisions. Most commits only need a title.
After all commits are made, use AskUserQuestion to ask if the user wants to push the branch.
Use conventional commits with scopes where applicable:
feat(scope): add new featurefix(scope): resolve bugrefactor(scope): restructure codetest(scope): add or update testsdocs(scope): update documentationchore(scope): maintenance taskMatch the scope style and conventions visible in the repo's recent git log. If the repo doesn't use scopes, omit them.
--no-verify)git add ., git add -A, or git add -u — always stage explicit paths from IN_SCOPEAskUserQuestion — never wait for freeform inputmain or master — only push feature/topic branches~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.