Sovereign git-commit-analyzer

Analyzes git commit history to report commit frequency, top contributors, file changes, and commit message quality for development insights.

This skill is coherent and implements a local git-history analyzer. Before installing: (1) review scripts/analyze.sh yourself (it will execute git commands in the repository) and only run it in repositories you trust, (2) be aware it reads full commit metadata and file histories (no network calls were found), (3) verify the publisher/source if provenance matters — registry metadata was inconsistent (registry listed no homepage/source while skill.json contains homepage/repository URLs), and (4) run the script manually first (./scripts/analyze.sh ...) to confirm behavior in a controlled environment. If you need higher assurance, request a signed upstream release or confirm the repository URL in skill.json matches a trusted source.

Type: OpenClaw Skill Name: sovereign-git-commit-analyzer Version: 1.0.0 The skill's stated purpose of analyzing git commit history is benign. However, the `scripts/analyze.sh` script is vulnerable to shell injection. User-controlled inputs such as `--branch`, `--author`, `--since`, `--until`, and `--days` are directly interpolated into `git log` commands without proper sanitization or quoting. This allows for arbitrary command execution if a malicious string containing shell metacharacters is provided as an argument, posing a significant remote code execution risk. The `SKILL.md` does not contain any prompt injection attempts.