git-commit

git-commit is a skill for Claude Code from bahayonghang/my-ai-cli-toolkit. It costs 218 tokens per session (6,384 once invoked), scanned A, original, MIT.

A workflow for creating Conventional Commits from Git changes. Conventional Commits are commit messages written in a consistent format so tools and teammates can understand them.

In plain words
What is it for?
Use it to review staged changes, split them into logical commits, write or draft commit messages, and verify the result without pushing.
Why use it?
It helps keep unrelated changes from being bundled together and avoids committing files the user did not intend to include.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions Claude Code; mentions Cursor.

Good fit Use it to review staged changes, split them into logical commits, write or draft commit messages, and verify the result without pushing.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/bahayonghang/my-ai-cli-toolkit/git-commit
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add bahayonghang/my-ai-cli-toolkit --skill git-commit
Clone the repo
git clone --depth 1 https://github.com/bahayonghang/my-ai-cli-toolkit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for git-commit

README.md
[![agentmods](https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/git-commit/github.svg)](https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/git-commit)
Your own site
<a href="https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/git-commit"><img src="https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/git-commit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for git-commit

Your own site · 80×15
<a href="https://agentmods.dev/skills/bahayonghang/my-ai-cli-toolkit/git-commit"><img src="https://agentmods.dev/badge/skills/bahayonghang/my-ai-cli-toolkit/git-commit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 218 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,384 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Anti-Refusal · line 134
    Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
    Fix: Remove jailbreak framing that nullifies safety policies or restrictions. Skill content must not instruct the agent to ignore its guidelines or operate without guardrails.
  • medium Excessive Agency · line 165
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00218 $0.06384
Opus 5.5 $0.00087 $0.02554
Sonnet 5.5 $0.00044 $0.01277
Haiku 4.5 $0.00022 $0.00638

Measured 1mo ago against content hash 3afcf8a1ade9, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

git-commit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 3 executable files (scripts/compose_commit_message.ps1, scripts/compose_commit_message.py, tests/compose-commit-message.test.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/git-github-collaboration/git-commit/SKILL.md · 175 lines

How it starts

The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Use this workflow in order: preflight -> split plan -> classify -> compose -> commit/draft -> verify.

Decide the active change authority and output language before doing anything else:

  • staged-only is the default. Respect the current index and treat unstaged or untracked files as context only.
  • all-changes is allowed only when the user explicitly asks to include everything, such as "all changes", "所有改动", "全部改动", "不管有没有 stage", or "包括未跟踪文件". In this mode, the skill may rebuild the index from the full working tree and should treat any existing partial staging as intentionally overridden by the user.
  • commit-language is detected, not fixed-default, because forcing one language fights repos (and users) whose history is already in the other. Resolve it in this order, then use it for scope, subject, body, and explanatory output:
    1. An explicit instruction in the user's message — "use English", "英文提交", "用中文", "中文提交", or the legacy phrase 请使用中文拆分提交所有的改动. Honor whichever language the user names.
    2. The dominant language of the user's current request message.
    3. The repository's own habit, sampled in Preflight from git log -n 20 --format=%s. Match what the repo already does so your commit doesn't read as an outlier.
    4. Fall back to English only when none of the above gives a clear signal. Language is orthogonal to emoji, [AI], and trailers: detecting Chinese never changes whether [AI] or agent trailers attach.
  • agent-mode is on by default whenever this skill runs (the caller is an agent). It attaches Agent-Task / Agent-Model / Generated-By trailers and applies the Why-line rule for feat / fix / refactor / perf. It does not inject [AI] in the header. Pass --ai only when the user explicitly says "add [AI] tag", "加 AI 标记", "加上 [AI]", or equivalent. Turn agent-mode off when the user says "no AI tag", "不要 AI 标记", "不加 agent trailer", or equivalent.
  • commit-channel is local git only. Create the commit with git commit -F <message-file> (or rtk proxy git commit -F). Do not create commits through GitHub's web UI, Contents API, Git Data API, GraphQL createCommitOnBranch, gh api file-commit helpers, GitHub MCP create_or_update_file / push_files, or a platform GitHub App (Cursor Agent, Copilot, Grok[bot], Devin). Those channels make GitHub show "This commit was created on GitHub.com." and often "Committed via ". Do not pass git commit --trailer for Co-authored-by, Made-with, or "Committed via" text.
  • Skill responsibility: local commit preparation, execution, and verification. git push, pull-request creation, git commit --amend, git rebase, and tags belong to other workflows. For mixed requests, preserve the user's full request and hand already-authorized remaining steps back to the main coordinator after verification (§7); the skill boundary does not end the request. A commit-only request grants no push or PR authorization.

1. Preflight

  1. Inspect git --no-optional-locks status --short --untracked-files=all first (include untracked files even when repository display defaults hide them). Then inspect the active change set:
    • staged-only: git diff --staged --stat and git diff --staged
    • all-changes: git diff --stat, git diff, git diff --staged --stat, and git diff --staged If rtk is required, use rtk proxy git --no-optional-locks status --short --untracked-files=all for the same complete status; do not replace it with compact rtk git status. Preserve optional-lock disabling for read-only preparation. Compact diffs may supplement inspection, but use unfiltered diffs when deciding file/hunk scope.
  2. Explicitly note:
    • the active change authority (staged-only or all-changes)
    • staged changes ready to commit
    • unstaged changes that might make the index misleading
    • untracked files that are intentionally excluded vs accidentally forgotten
  3. Branch immediately on preflight results:
    • Either mode + no staged, unstaged, or untracked changes: say there is nothing to commit.
    • staged-only + no staged changes but working-tree changes exist: continue read-only preparation. List candidate paths with staged/unstaged/untracked states; check paths and sizes for secrets/large/binary risks before reading the necessary safe diffs or untracked text. Continue through repository conventions, supported split planning, classification, and message drafts. Label candidates as unapproved for staging; do not change the index, product files, or history, or run git commit. Use read-only inspection with optional Git locks disabled so even index refresh is avoided. Report the exact blocker: the index is empty and staging is not authorized by this mode. Distinguish this from missing commit consent; do not ask again whether to commit when that is already authorized. If candidate grouping or intent is unclear, give only supported groups/drafts and the unresolved decision instead of inventing a final file set or message. A risky path may be listed without exposing its contents; preparation of other safe candidates can continue. This branch does not enable a new staging mode or authorize staging named files.
    • The active change set exists but is obviously mixed and cannot be safely separated from inspection alone: do not improvise a commit. Output a split plan and stop.
    • The user explicitly asked only for commit text, a draft, or suggestions: continue through classification and composition, but do not run git commit.
  4. Detect agent context (skip when user disabled agent-mode):
    • Resolve agent-model from the id of the model currently running this skill — read the runtime's own id (e.g. claude-fable-5 when that is the running model), never a model id copied from an example, which goes stale. This value is required.
    • Resolve agent-task by trying, in order: (a) explicit task ID or issue URL in the user message, (b) closes #N / refs #N mentioned by the user, (c) ticket ID extracted from the current branch name, (d) Agent-Task value from the previous commit on this branch, (e) fallback to unspecified.
    • Resolve agent-prompt-ref only when a stable prompt reference exists; otherwise leave empty.
    • Detect checkpoint-mode: triggered by user words such as checkpoint, 打个 checkpoint, 先存一下, WIP, [WIP], work in progress, 先提交一下,待会再整理.
  5. Sample repository conventions so the skill adapts instead of imposing one repo's habits everywhere:
    • Language + style: read git log -n 20 --format=%s. Note the dominant subject language (this feeds commit-language step 3 in §0) and whether subjects carry gitmoji. History that already contains [AI] is informational only — do not copy [AI] into new commits unless the user opted in.
    • Config: if commitlint.config.*, .commitlintrc*, .czrc, .cz.*, .gitmessage, or a CONTRIBUTING commit section exists, treat its allowed type / scope list and length rules as authoritative over this skill's defaults. Pass a repo length rule to the composer via --max-header-width (§4) and a repo custom type via --type as-is (§4).
    • AI attribution: from the same git log sample plus CONTRIBUTING / AI-policy files, note whether the repo already has an AI attribution convention such as Assisted-by: or Generated-by: trailers. If it does, the repo convention wins over this skill's private trailer scheme — see §3.4 and references/agent-workflow.md. Do not treat host/client badges (Co-authored-by: Cursor, Made-with: Cursor, "Committed via …") as a repo convention to copy.
    • When no signal exists, fall back to this skill's defaults: emoji on, agent trailers on, [AI] off, local git commit -F only, scope from the changed path.
  6. Safety scan the active change set's file list (git diff --staged --name-only, plus untracked paths in all-changes). If it includes likely secrets (.env, *.pem, *.key, id_rsa, id_ed25519, *.p12, *.keystore) or large/binary blobs (> ~1 MB), do not commit silently. Surface each risky path with its staged/untracked/tracked state, size when practical, and why it is risky. For large files, ask the user to decide per path before staging or committing: intentionally commit it, leave it untracked, add or adjust a .gitignore pattern, or move it to Git LFS / external artifact storage. Do not treat all-changes as permission to sweep every large file into history. "Safely orchestrate" means catching leaked secrets and accidental artifacts before they enter history, not only splitting commits cleanly.

Read the full file on GitHub · 175 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +1 lines 3afcf8a1ade9
  2. 1mo ago Changed · +8 lines · +15 tokens per session e14348b8b320
  3. 1mo ago First seen · 166 lines · 203 tokens per session scan A f12353836108

Subscribe to this mod's changes

git-commit is a skill published in the GitHub repository bahayonghang/my-ai-cli-toolkit (17 stars, last pushed 3d ago), licensed MIT. It adds 218 tokens to every session and 6,384 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

git-authoring

Authors and executes git work end to end — Conventional Commits messages, pull-request content, release notes, and pull-request review, plus the repository operations an engineer runs daily: branching, rebasing, squashing, cherry-picking, reverting, merge-conflict resolution, stashes, tags, remotes, and recovery…

n-shadloo/git-authoring · 225 tokens

commit-staged

This skill should be used when user asks to "commit these changes", "write commit message", "stage and commit", "create a commit", "commit staged files", or explicitly invokes "commit-staged".

fcakyon/claude-codex-settings · 46 tokens

git-workflow

Use when naming or scoping a branch, writing or fixing a commit message, picking the gitmoji for a commit, untangling history (rebase versus merge versus squash), or cutting a versioned release — the portable git-convention layer for any repo. Covers gitmoji + Conventional Commits, SemVer tags, branch hygiene…

ericrisco/rsc-harness · 127 tokens

git-commit

Creates git commits following Conventional Commits format with type/scope/subject. Use when user wants to commit changes, create commit, save work, or stage and commit. Enforces project-specific conventions from CLAUDE.md.

fvadicamo/dev-agent-skills · 49 tokens

gmc

Use the gmc CLI for explicit gmc requests: generate commit messages, create or remove worktrees, prune merged worktrees, discover or sync shared resources, or run other gmc wt subcommands. Triggers mainly when the user invokes /gmc or mentions gmc wt add, gmc wt prune, gmc wt share, gmc wt sync, gmc tag, or asks to…

samzong/gmc · 123 tokens

stage

Use when committing work from the current session to stage ONLY hunks the session touched, not the entire file. Prevents accidentally staging unrelated uncommitted changes from other work.

photostructure/coding-skills · 37 tokens