Shadows Smart Commit

Intelligent git commit assistant — analyzes diffs, enforces conventional commits, detects secrets, generates meaningful messages. Use when committing code ch...

This skill appears to do what it says (analyze diffs, enforce conventional commits, run a local grep-based secret scan) and has low installation impact, but please consider the following before installing or invoking it: 1) Git hooks: commits can trigger local hooks (pre-commit, commit-msg, post-commit) which may execute arbitrary scripts, possibly including network calls or data exfiltration; the skill does not check for hooks — inspect .git/hooks and any hook frameworks (pre-commit, husky) in your repo before using. 2) Secret handling: the secret scan echoes matched lines to terminal output; if you run this in terminals with shared logging, CI, or telemetry, secrets may be exposed — run in a secure local terminal or enhance scanning with a vetted tool (gitleaks/trufflehog) for higher assurance. 3) Metadata mismatch: SKILL.md contains a homepage URL while the registry shows none; if provenance matters, verify the publisher/site before trusting. 4) Test first: try the instructions in a disposable repository to confirm behavior (and to check for unexpected hooks). If you need strict guarantees about network isolation or secret handling, prefer a vetted binary/toolchain or expand the workflow to detect and neutralize hooks and to avoid printing secret values.

Type: OpenClaw Skill Name: shadows-smart-commit Version: 1.1.0 The 'smart-commit' skill is a legitimate utility designed to assist with git operations by enforcing security scans and conventional commit standards. It uses standard git commands and grep-based patterns in SKILL.md to detect secrets and sensitive files (e.g., .env, .pem) before committing, and explicitly forbids risky practices like 'git add .'. No evidence of data exfiltration, network access, or malicious intent was found.