commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Preferences and best practices for interacting with a git repository.
ALWAYS use git add with specific files that have been updated. NEVER use git add . or git add -A.
IF adding files that look like they are agent configuration, or adding planning documentation, ALWAYS prompt the user to confirm if they should be included or not.
PREFER writing the commit message to a file under $TMPDIR, named for what is being committed, then commit with git commit -F "$TMPDIR/path-to-message.txt".
Use -F (--file), NEVER -t (--template). A template opens the message in an editor and git aborts if it comes back unchanged (Aborting commit; you did not edit the message.). Agent shells run with a no-op editor, so -t always aborts. The abort comes after pre-commit hooks run, so the failure looks like a hook problem. It isn't; don't reach for --no-verify.
Put any trailers your instructions require (e.g. Co-Authored-By:) at the end of the message file. Writing the message to a file first makes these easy to forget.
PREFER git commit -F <file> -- <path>... over a bare git commit. A bare commit takes everything currently staged, including files another session or tool staged in the same working tree between your git add and your git commit. Naming the paths commits only what you meant to.
Path-limited commits take the working-tree version of those files, so skip -- <path> when you deliberately staged only some hunks of a file.
We have git commit signing setup. If it fails due to a message like:
error: 1Password: failed to fill whole buffer
fatal: failed to write commit object
... it is because the user was being prompted to authorize signing, and didn't see it or missed it. Do not try to fix or bypass it. Stop and prompt the user about either fixing it, or confirm bypassing it.
When git precommit checks fail, analyze what the failures are, and try to autofix when possible, otherwise think through how to fix it. Ask the user how to proceed when it's unclear if how to fix.
DO NOT follow sorbet's autocorrection advice. DO NOT skip verification without confirmation from the user.
If we see errors like:
git: 'duet-prepare-commit-msg' is not a git command. See 'git --help'.it is because we previously were using git-duet. It uses a git template, with hooks that call git duet-prepare-commit-msg. We've sinced moved, but the files will still be present
In this case, check .git/hooks/ for references to these. Remove files that call it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.