Report 01M7G56M3M83P5VV7P6YSKBARE · checks-v2

git-commit skill: automated checks

What HostedMCP checked on 15 Nov 2026, 17:48 UTC. Every result links to the public source it came from, so you can check it yourself.

Not verified

85/100

7 of 7 checks ran · 0 high findings · not a security audit

Checked: 15 Nov 2026, 17:48 UTC
Folder: orc/skills/git-commit ↗
Files read: SKILL.md and scripts
Methodology: checks-v2

What to fix for a higher score

2 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Pre-approved tools are scoped up to +10 pts
Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.
SKILL.md follows the Agent Skills format up to +5 pts
Start SKILL.md with front matter holding a name (lowercase letters, digits and hyphens, the same as the folder) and a description under 1,024 characters that says what the skill does and when to use it.

Origin

25 / 25 points

Source repository linked and reachable10 pts
higoralves/orc/orc/skills/git-commit is public and reachable
github.com/higoralves/orc/tree/HEAD/orc/skills/git-commit ↗
Pass
Open source license (OSI)10 pts
MIT
spdx.org/licenses/MIT.html ↗
Pass
Commit or release in the last year5 pts
Last commit 2026-11-06
github.com/higoralves/orc/commits ↗
Pass

Scripts

30 / 30 points

No download-and-run or credential theft in scripts30 pts
No scripts in the skill folder
Pass

Instructions to the agent

20 / 30 points

No hidden instructions in SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/higoralves/orc/blob/HEAD/orc/skills/git-commit/SKILL.md ↗
Pass
Pre-approved tools are scoped10 pts
Bash lets the agent run any shell command without asking
github.com/higoralves/orc/blob/HEAD/orc/skills/git-commit/SKILL.md ↗
How to fix: Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.
Finding

Format

10 / 15 points

SKILL.md follows the Agent Skills format10 / 15 pts
the description does not say when to use the skill
github.com/higoralves/orc/blob/HEAD/orc/skills/git-commit/SKILL.md ↗
How to fix: Start SKILL.md with front matter holding a name (lowercase letters, digits and hyphens, the same as the folder) and a description under 1,024 characters that says what the skill does and when to use it.
Partial

What these checks do not cover

Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
Results describe the skill folder on the date above; a later commit can differ.
A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.

What to fix for a higher score

2 checks can earn more points. The next scan runs within a week, or right after the repository changes.

Pre-approved tools are scoped up to +10 pts

Narrow allowed-tools to the commands the skill needs, for example Bash(git status:*), not Bash or Bash(curl:*). The agent still asks before anything else.

SKILL.md follows the Agent Skills format up to +5 pts

Start SKILL.md with front matter holding a name (lowercase letters, digits and hyphens, the same as the folder) and a description under 1,024 characters that says what the skill does and when to use it.