Git Commit Skill Security Audit

The skill actively runs `git commit` and says not to use `--no-verify` unless requested, so applicable Git commit hooks are normally allowed to run. If the repository or local environment supplies malicious or unexpected hooks, they may execute commands during the commit and affect files or credentials. No hook code is included, so its actual behavior cannot be determined. A user can require applicable hooks to be listed and reviewed first, or restrict execution in an untrusted repository.

The workflow first inspects working-tree changes with `git diff`, which does not show the contents of untracked files, and later permits wildcard staging. A newly matched file could therefore be committed after only its path—not its contents—was reviewed. Although the document explicitly forbids committing secrets, it does not require a final review of the complete staged diff. A user can require explicit file lists and review `git diff --staged` before committing.