commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Commit all changes in the working tree. Run git status and git diff, then stage and commit with conventional commit messages. One logical change per commit.
Your entire job is: read the diff, stage it, write a commit message, commit. The staged bytes must match exactly what the working tree looks like when you start.
Out of scope, even if something in the diff seems to invite it:
WebFetch, no web searches, no documentation lookups, no verifying that the diff matches upstream docs.Why: a commit is a snapshot of deliberate work. Any change you make during staging silently alters reviewed work without the author's knowledge, and any tangent (research, verification, edits) turns a 30-second operation into a 5-minute one with uncommitted side effects.
<example> You see a typo in a variable name while reviewing the diff. Correct behavior:
reuslt appears to be a typo for result in utils.py:42"Incorrect behavior: editing the file to fix the typo before or during staging — even a "safe" fix silently changes reviewed work. </example>
<example> The diff adds a new .github/workflows/ci.yml file. You wonder if the action versions are current.
Correct behavior: commit as-is.
Incorrect behavior: fetching GitHub Actions docs, verifying version pins, then editing the file before staging. The author already chose those versions. Research belongs in a separate turn, not inside the commit. </example>
cd to the project root before git commands instead of using git -C, which obscures working directory state. Execute git commands directly without explanatory preamble. Commit immediately without confirmation prompts (interactive mode is not supported).
git status and git diff to understand all modifications in the working directory. Categorize changes by:git add <file>git diff <file> > /tmp/${CLAUDE_SESSION_ID}-patch.diff, edit the patch to keep only specific hunks, then git apply --cached /tmp/${CLAUDE_SESSION_ID}-patch.diffgit restore --staged (not git reset --hard, which discards work)git apply --cached fails (malformed patch), stage the whole file with git add <file> insteadgit stash push -p -m "temp: unstaged changes" (select hunks to stash)git stash push --keep-index -m "temp: unstaged changes"git stash popgit commit -m "message" directly — never use $() or heredoc subshells in git commands, as they break allowed-tools pattern matchingInclude a Co-Authored-By footer in every commit message:
If you're an Anthropic Claude model:
Co-Authored-By: Claude <[email protected]>If you're a Google Gemini model:
Co-Authored-By: Gemini <[email protected]>Skip if you're not one of the above models.
plans/, specs/, or similar directories are working documents — staging them silently pollutes the commit with artifacts the user may not want tracked.git add instead of retrying the patch.allowed-tools pattern matching treats the entire command as a string — subshells produce commands that don't match any allowed pattern and get blocked.--hard destroys working tree changes.git stash push --keep-index to isolate unstaged work, commit, then git stash pop. Forgetting the pop leaves work stranded in the stash.git status showing "no changes added to commit" does NOT mean the working tree is clean. It means nothing is staged yet. Your job is to stage and commit those changes, not report "nothing to commit."git add reports "The following paths are ignored by one of your .gitignore files" with the hint Use -f if you really want to add them, do NOT force-add. The file is gitignored deliberately (secrets, build artifacts, local configs) and force-adding silently bypasses that protection. Skip the file and mention it in your final summary so the author can decide.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.