Stop writing "fix stuff". AI agent skill for gold-standard git commits across Claude Code, Cursor, Codex & Windsurf
SaferSkills independently audited Smart-git-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Produces gold-standard Git commits: tested, atomic, secure, documented, and traceable. Follow every phase below in order. Never skip phases unless the user explicitly says so.
<!-- line-limit: 500 -->
Check for CLAUDE.md, .gitmessage, .git/COMMIT_TEMPLATE at repo root. If found, those rules override this skill's defaults.
cat CLAUDE.md 2>/dev/null && echo "→ Found CLAUDE.md"
cat .gitmessage 2>/dev/null && echo "→ Found .gitmessage"Show what rules were loaded before proceeding.
Run full diff analysis before touching git add:
git status
git diff --stat # which files, how many lines
git diff # full diff for small changesets
git log --oneline -5 # recent commit contextCategorize every changed file:
| Path pattern | Category |
|---|---|
src/ lib/ app/ | feature/fix/refactor |
tests/ *.test.* | test |
docs/ *.md | docs |
package.json deps | chore |
.github/ Makefile | tooling |
If files span more than one category → flag for atomic split in Phase 4. Read references/atomic-patterns.md if split is needed.
Run the automated security scanner:
bash scripts/scan-secrets.shIf secrets found:
git reset HEAD <file> to unstage.gitignore if neededRead references/security-rules.md for the full pattern list.
Auto-detect and run the project's test suite:
bash scripts/detect-test-runner.shSupported runners: npm test, pytest, cargo test, go test, make test, rspec, mix test, gradle, ctest.
If Phase 1 found multiple concerns:
bash scripts/split-commits.shShow the proposed split plan. Execute each commit group in sequence (Phases 5-7 repeat per group).
If single concern: proceed directly to Phase 5.
Read references/atomic-patterns.md for splitting strategies.
Use the 5-part format for every commit. No exceptions.
<type>(<scope>): <imperative summary — max 72 chars>
CONTEXT: <what state existed BEFORE this change — past tense>
CHANGE: <exactly what was done — present tense, specific>
WHY: <business or technical reason — not obvious from the code>
IMPACT: <what this enables/unblocks, or "No breaking changes">
<footers>feat fix perf security refactor test docs chore hotfix revert release| Field | Rule | Good | Bad |
|---|---|---|---|
| CONTEXT | Past tense, describes the gap | "Auth tokens had no expiry" | "There was a bug" |
| CHANGE | Present tense, specific | "Adds 15-min sliding expiry with refresh rotation" | "Fixed the token thing" |
| WHY | Not obvious from code | "Required for SOC2 compliance" | "To improve security" |
| IMPACT | Downstream effect | "Enables audit logging of token refresh events" | "Things are better now" |
fix(payments): prevent double-charge on Stripe webhook retry
CONTEXT: Stripe delivered webhooks twice under high load due to 30s
application timeout, causing duplicate charges.
CHANGE: Adds idempotency_key (order_id + unix_ts hash) to all Stripe
charge requests.
WHY: Stripe's API natively deduplicates on idempotency keys — simpler
than Redis-based deduplication.
IMPACT: Eliminates billing support tickets for duplicate charges.
Closes #301Read references/message-examples.md for 15 full examples.
Auto-detect from branch name:
git branch --show-current | grep -oE '[0-9]+'Check for open issues:
gh issue list --state open 2>/dev/null | head -20Use the correct footer keyword:
| Footer | Intent |
|---|---|
Closes #N | Fully resolves (auto-closes on merge) |
Fixes #N | Bug fix (same as Closes) |
Refs #N | Related but does not close |
Part of #N | One commit in a larger effort |
If no issue found, ask user before proceeding.
Stage selectively — never git add . blindly:
git add <specific files or directories>
git diff --cached --stat # verify before committing
git commit -m "<subject>" \
-m "CONTEXT: ...
CHANGE: ...
WHY: ...
IMPACT: ..." \
-m "<footers>"
git show --stat HEAD # confirm afterNever push directly to main or develop. Always push to feature branch:
git push origin HEAD
git push --set-upstream origin <branch> # if new branchShow commits being pushed:
git log --oneline origin/main..HEADIf on a feature branch after push:
bash scripts/create-pr.shTriggers on: "release", "ship", "version bump", "tag this"
bash scripts/generate-changelog.shThen:
package.json, pyproject.toml, Cargo.tomlchore(release): bump version to vX.Y.Z (with 5-part format)git tag -a vX.Y.Z -m "Release vX.Y.Z"git push && git push --tagsRead references/release-workflow.md for full semver guide.
| Scenario | Start at Phase |
|---|---|
| Single clean commit | Phase 1 |
| Secret found | Phase 2 → fix first |
| Tests failing | Phase 3 → fix first |
| Mixed concerns in diff | Phase 4 |
| Already staged, need msg | Phase 5 |
| Need to push + open PR | Phase 8 |
| Release / version bump | Phase 10 |
| Hotfix on main | Phase 0 → check rules |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.