commit skill
✓ VerifiedCreates standardized git commits by detecting repository conventions and performing automated secret scanning with GitLeaks or TruffleHog.
- GitHub stars
- 8
- Files
- 10
- Last commit
- Nov 11, 2026
- License
- MIT
- Allowed tools
- 4
What does the commit skill do?
commit creates standardized git commits by detecting repository conventions and performing automated secret scanning with GitLeaks or TruffleHog.
Summary generated from the skill's SKILL.md.
About the commit skill
Automating standardized git commits while preventing credential leaks is what this skill enables for developers. It functions by analyzing repository history and ecosystem guides to identify whether a project uses conventional commits, area prefixes, tracker IDs, or plain text formats. When an agent needs to stage files or save work, it loads this skill to ensure the resulting message matches the existing project style.
Security is integrated directly into the workflow through automated scanning of staged changes. The tool uses GitLeaks by default or TruffleHog if the project already utilizes it, piping the staged diff into the scanner to catch secrets before they are recorded. It relies on bash commands for git, gitleaks, and trufflehog to perform these checks. If a scanner is missing, the skill informs the user rather than attempting an implicit installation, ensuring that no unscanned commits are made without explicit permission.
What an agent can do with it
- 1Standardize repository commit messagesCreate a git commit that follows the specific convention used in this existing codebase.
- 2Prevent accidental secret exposureScan my staged changes for sensitive credentials using GitLeaks before finalizing the commit.
Written from the skill's SKILL.md. Every use case is checked against a quote from it.
How to install the commit skill
Each command copies the skill folder into the client's skills directory. Restart the client or start a new session to load it.Install the commit skill in Plugin
/plugin marketplace add tartinerlabs/skills /plugin install workflow@tartinerlabs
Install the commit skill in Claude Code
~/.claude/skills/commit/SKILL.md
$ npx degit tartinerlabs/skills/plugins/workflow/skills/commit ~/.claude/skills/commitInstall the commit skill in Claude Code (project)
.claude/skills/commit/SKILL.md
$ npx degit tartinerlabs/skills/plugins/workflow/skills/commit .claude/skills/commitInstall the commit skill in Codex
~/.agents/skills/commit/SKILL.md
$ npx degit tartinerlabs/skills/plugins/workflow/skills/commit ~/.agents/skills/commitInstall the commit skill in Gemini CLI
~/.gemini/skills/commit/SKILL.md
$ npx degit tartinerlabs/skills/plugins/workflow/skills/commit ~/.gemini/skills/commitInstall the commit skill in Claude.ai
npx degit tartinerlabs/skills/plugins/workflow/skills/commit commit && zip -r commit.zip commit # claude.ai → Customize → Skills → + → Create skill → Upload a skill → commit.zip
Automated checks
Ran Nov 14, 2026Full report →Passed our automated checks. That is not a security audit: read the scripts before you let an agent run them. How checks work
- Source repository linked and reachabletartinerlabs/skills/plugins/workflow/skills/commit is public and reachablegithub.com/tartinerlabs/skills/tree/HEAD/plugins/workflow/sk ↗Pass
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit 2026-11-11github.com/tartinerlabs/skills/commits ↗Pass
- No download-and-run or credential theft in scriptsNo scripts in the skill folderPass
- No hidden instructions in SKILL.mdNo override phrases, safeguard switches, credential requests or hidden charactersgithub.com/tartinerlabs/skills/blob/HEAD/plugins/workflow/sk ↗Pass
- Pre-approved tools are scopedPre-approved: Read, Bash(git:*), Bash(gitleaks:*), Bash(trufflehog:*)github.com/tartinerlabs/skills/blob/HEAD/plugins/workflow/sk ↗Pass
- SKILL.md follows the Agent Skills formatValid name and description; says when to use it; 51 linesgithub.com/tartinerlabs/skills/blob/HEAD/plugins/workflow/sk ↗Pass
SKILL.md
View on GitHubYou create git commits with short, readable messages that match the repository's existing convention.
Load an ecosystem guide only when rules/convention-detection.md reaches Tier 3 and the manifest matches it: references/go.md, references/swift.md, references/python.md, references/systems.md.
Rules Overview
| Rule | Impact | File |
|---|---|---|
| Convention detection | HIGH | rules/convention-detection.md |
| Message format | HIGH | rules/message-format.md |
| Commit type selection | HIGH | rules/commit-type.md |
| Issue references | MEDIUM | rules/issue-references.md |
| Change scope | MEDIUM | rules/change-scope.md |
Pre-Commit Security Check
Scan staged changes for secrets before every commit, using the project's secret scanner. GitLeaks is the default; TruffleHog is accepted if the project already uses it.
- Run the scanner over staged changes after staging, piping the staged diff into its stdin mode — GitLeaks:
git diff --cached | gitleaks stdin --redact --verbose; TruffleHog:git diff --cached | trufflehog stdin --results=verified,unknown --fail(includeunknownso credentials TruffleHog cannot verify online still block the commit, matching GitLeaks). Piping keepsgita plain command, so worktree-isolated sessions accept it;gitleaks gitandtrufflehog gitpassgitas an operand and are refused there. - If the scanner reports a leak, STOP — do not commit. Report the finding and ask the user to remove the secret (and rotate it if it was ever pushed).
- If no secret scanner is installed (command not found), do not install one implicitly. When the project's pre-commit hook runs a scanner, commit and let the hook scan. Otherwise tell the user no scanner is available, suggest installing one (
brew install gitleaksor equivalent), and ask before committing unscanned.
Never edit .husky/, commitlint, or other project tooling as part of a commit. If pre-commit hooks are missing, report that and point the user to the setup skill instead of configuring it yourself.
Workflow
A commit request stages and commits only — it must never pull, stash, restore stashes, or rewrite project tooling.
- Show current
git statusand analyse all changes - Detect the repository's commit convention (see
rules/convention-detection.md) - Check conversation context for issue references (see
rules/issue-references.md) - Assess scope of changes (see
rules/change-scope.md) - Stage only the explicit, related paths for this change — never blanket-stage unrelated modifications
- Choose the commit type or leading verb from branch context, not the staged diff alone (see
rules/commit-type.md) - Run the Pre-Commit Security Check above
- Create the commit with a message following
rules/message-format.md
When the convention came from Tier 3 or Tier 4 of detection — an ecosystem default or the plain fallback rather than enforced tooling or clear history — state which convention was used and why, so a wrong guess is visible.
Files in this skill
10commit skill questions
How do I install the commit skill in Claude Code?
Run npx degit tartinerlabs/skills/plugins/workflow/skills/commit ~/.claude/skills/commit. Claude Code loads skills from ~/.claude/skills (all projects) or .claude/skills (one project) and uses a skill when its description matches the task.
Which clients can use the commit skill?
Any client that reads the Agent Skills format: Claude Code, Codex, Gemini CLI and claude.ai (upload as a ZIP). Scripts in the skill run only where the client allows code execution.
What happens if a secret is detected during the commit process?
The commit process will stop immediately. The agent will report the finding and ask you to remove the secret and rotate it if it was previously pushed.
Which secret scanners are supported?
GitLeaks is the default scanner, but TruffleHog is also accepted if the project already uses it.
Will the tool install a secret scanner if one is missing?
No, the tool will not install a scanner implicitly. It will inform you that no scanner is available and suggest installation methods like brew.