Automatically generates standardized Git commit messages by analyzing code changes, supporting multiple languages and Conventional Commits format.

This skill appears to implement the advertised commit-message generator and only invokes git commands (execSync) to read staged diffs — that's expected. However: 1) Inspect SKILL.md for invisible/control characters and remove them; they are a common prompt-injection vector. 2) Review index.js locally: execSync is used but only with hard-coded git commands ('git rev-parse' and 'git diff --cached --stat'), which is reasonable; ensure you run it in a trusted repository and not in a directory containing sensitive files. 3) Run the included test.js in a sandbox or throwaway repo to confirm behavior. 4) Because the publisher/source is unknown, be cautious about giving this skill broad access in automated/autonomous contexts; prefer manual invocation until you are satisfied. If you are not comfortable inspecting files yourself, do not install from this unknown source.

Type: OpenClaw Skill Name: git-commit-helper-pro Version: 1.0.0 The 'git-commit-helper-pro' skill is a legitimate utility designed to automate the generation of Git commit messages by analyzing repository changes. The core logic in `index.js` uses `child_process.execSync` to execute standard Git commands (`git diff --stat`), but these calls use hardcoded strings and do not incorporate unsanitized user input, preventing shell injection. The skill contains no external dependencies, no network activity, and no instructions in `SKILL.md` that would suggest malicious intent or data exfiltration.