clean-commits — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clean-commits (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every commit is atomic, descriptive, and leaves code in a working state.
Core principle: Anyone should be able to checkout any commit and have working code.
Announce at use: "I'm committing with a descriptive message following clean-commits standards."
[type](scope): Short description (max 72 chars)
[Optional body - what and why, not how]
[Optional footer - issue references, breaking changes]
Refs: #[ISSUE_NUMBER]| Type | Use For |
|---|---|
feat | New feature |
fix | Bug fix |
docs | Documentation only |
style | Formatting, no code change |
refactor | Code restructuring |
test | Adding/fixing tests |
chore | Maintenance, dependencies |
feat(auth): Add user registration endpoint
Implement POST /api/users/register with email validation,
password hashing, and duplicate detection.
- Validates email format and uniqueness
- Hashes password with bcrypt
- Returns user object without password
Refs: #123fix(auth): Prevent redirect loop on expired session
Session expiry was triggering redirect to login, which
checked session, found expired, and redirected again.
Now clears session cookie before redirecting.
Refs: #456test(auth): Add integration tests for registration
Cover success case, duplicate email, invalid format,
and weak password scenarios.
Refs: #123| Atomic | Not Atomic |
|---|---|
| One logical change | Multiple unrelated changes |
| Passes all tests | Breaks tests |
| Complete feature slice | Half-implemented feature |
| Can be reverted cleanly | Reverts would break things |
If you have multiple changes, commit them separately:
# Stage specific files
git add src/auth/register.ts
git add src/auth/register.test.ts
git commit -m "feat(auth): Add registration endpoint"
# Stage next logical unit
git add src/auth/login.ts
git add src/auth/login.test.ts
git commit -m "feat(auth): Add login endpoint"Every commit must leave the codebase in a state where:
Before committing:
# Run tests
pnpm test
# Check build
pnpm build
# Check types
pnpm typecheck
# Check lint
pnpm lintIf any fail, fix before committing.
| Too Infrequent | Just Right |
|---|---|
| "Implement entire feature" | "Add user model" |
| "Fix all bugs" | "Fix session expiry redirect" |
| "Update everything" | "Update auth dependencies" |
Smaller commits are:
# Review what changed
git diff
# Stage specific files
git add [specific files]
# Or stage interactively
git add -p# See what will be committed
git diff --staged# Short message (if simple)
git commit -m "fix(auth): Handle null user in session check"
# Long message (if complex)
git commit
# Opens editor for full message# Check commit looks right
git show --stat
# Verify tests still pass
pnpm testWhen to include a body:
refactor(api): Extract validation middleware
Validation logic was duplicated across 12 endpoints.
Extracted to reusable middleware that can be composed.
Alternative considered: validation library.
Rejected because our rules are domain-specific.fix(data): Use optimistic locking for updates
Race condition was causing lost updates when two users
edited the same record simultaneously.
BREAKING CHANGE: Update operations now require
version field in request body.Always reference the issue:
# In commit message
Refs: #123
# Or if commit closes the issue
Closes: #123# Amend last commit (before push only!)
git add forgotten-file.ts
git commit --amendIf a commit was wrong:
# Create a new commit that undoes the change
git revert [commit-sha]
# DON'T rewrite history on shared branches
# DON'T force push to fix mistakesBefore each commit:
This skill is called by:
issue-driven-development - Throughout developmentpr-creation - Before creating PRThis skill enforces:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.