Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/summersec/sumsec-skills/git-commit-prnpx skills add SummerSec/SumSec-Skills --skill git-commit-prgit clone --depth 1 https://github.com/SummerSec/SumSec-SkillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.04475 |
| Opus 5 | $0.00024 | $0.02237 |
| Sonnet 5 | $0.00010 | $0.00895 |
| Haiku 4.5 | $0.00005 | $0.00447 |
Grade A, and why
git-commit-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 372 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Git Commit & PR 自动化助手
用于在真实仓库里安全地完成 commit、push、PR/MR。
目标不是“机械跑命令”，而是先识别仓库状态、分支状态、远程状态和平台能力，再选择合适路径执行。
核心能力
- 识别用户目标：
仅提交、仅创建 PR/MR、提交并创建 PR/MR - 识别仓库状态：工作区脏/净、当前分支、是否跟踪远程、默认基线分支
- 基于仓库历史生成更贴近本仓库风格的 commit message
- 先处理分支，再提交，再推送，再创建 PR/MR，避免顺序错误
- 优先使用
ghCLI 自动创建 PR，失败时降级为平台链接 - 覆盖常见失败路径：未登录、无远程、远程拒绝、分支冲突、hook 失败、无可创建 PR 的提交
操作边界
- 只在用户明确要求“提交 / 推送 / 创建 PR/MR”时执行这些动作。
- 不要默认
git add .；先列出变更，再确认是“全部提交”还是“指定文件提交”。 - 不要提交疑似敏感文件，如
.env、密钥、凭证、tokens、私钥导出文件；若用户坚持，先明确提醒风险。 - 不要擅自改
git config。 - 不要默认使用
--force/--force-with-lease/--amend/--no-verify；只有用户明确同意后才能使用。 - 若当前在
master/main且要新增本地提交，优先新建分支，不要直接在主干上开发式提交。 - 若工作区有与本次目标无关的脏改动，先让用户决定是只暂存相关文件，还是拆分处理。
入口判断
先确认用户属于哪一种目标，再走对应路径：
- 仅提交
- 用户要求“帮我 commit / 提交代码”，但没有要求创建 PR/MR。
- 仅创建 PR/MR
- 工作区已经干净，且当前分支已有本地提交，用户只想发 PR/MR。
- 提交并创建 PR/MR
- 用户希望从本地修改一路完成到远程 PR/MR。
若用户描述不清，先问一句：
“你是要我只提交 commit，还是要连 push 和 PR 一起做？”
执行前快照
开始前至少检查以下信息：
git status --short --branchgit diff --statgit diff --cached --statgit log --pretty=format:"%s" -n 20git branch --show-currentgit remote -v
若要创建 PR，再补：
git remote show origin或等价命令，确认默认基线分支gh auth status- 当前分支是否已跟踪远程
git diff <base-branch>...HEAD --stat，确认确实有 PR 内容
工作流程
1. 环境前置检查
- 执行
git status，确保当前目录是 git 仓库。 - 检查
git remote -v，确认至少存在一个远程。 - 若存在多个远程（如
origin、upstream），在推送和建 PR 前确认使用哪个远程。 - 若用户要创建 GitHub PR，检查
gh auth status；未登录则提示用户先登录，或降级为创建链接。
2. 变更状态分析
- 列出未暂存、已暂存、未跟踪文件，区分：
unstagedstageduntracked
- 若工作区干净：
- 且当前分支相对基线已有提交：可直接进入
push / PR。 - 且没有新增提交：提示“没有可提交或可建 PR 的内容”。
- 且当前分支相对基线已有提交：可直接进入
- 若工作区不干净：
- 先确认提交范围，而不是默认整仓提交。
- 若检测到疑似敏感文件：
- 中断自动提交，先向用户确认。
3. 暂存策略
- 默认顺序：
- 展示改动文件清单
- 让用户确认“全部提交”还是“指定文件提交”
- 再执行
git add <files>
- 只有当用户明确表示“全部一起提交”时，才可使用整批暂存。
- 若仓库中已有用户自己的脏改动，优先只暂存本次相关文件，避免误提交。
4. 分支管理
- 获取当前分支名
git branch --show-current。 - 若当前分支为
master或main：- 若用户只是补一个历史 commit 且明确要求直接在当前分支提交，再按用户意图执行。
- 否则优先创建新分支再提交。
- 推荐分支命名：
feat/<description>fix/<description>docs/<description>refactor/<description>chore/<description>
- 分支检查点：
- 名称合法
- 本地是否已存在
- 远程是否已存在
- 是否需要切换到已有分支而不是新建
- 若当前已经在功能分支上，则沿用当前分支。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 372 lines · 48 tokens per session scan A 8abb25959e7b
git-commit-pr is a skill published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 17d ago), licensed Apache-2.0. It adds 48 tokens to every session and 4,475 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
editing-cordis-compositions
Use when creating, changing, or validating a Cordis composition for this harness — writing or editing an agent preset, adding or removing a plugin row, deciding whether something belongs to the host composition or to one session, checking whether a preset you authored actually mounts, or diagnosing a row that mounted…
dsh-trim-cot-leakage
Use when auditing or fixing prose that reads like a leaked reasoning transcript — dead design-session citations such as (decision N), audit item codes, or §N of uncommitted drafts; change narration such as "used to", "no longer", "this cut"; stack or review vantage ("a later PR in this stack", "rejected in review")…
dsh-web-pre-push-checks
Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.
dsh-web-documentation
Use when adding or editing dsh-web README files, docs, AGENTS.md instructions, user-facing configuration text, or bilingual documentation pairs.
dsh-web-sdk-compatibility
Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh-web from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled DSH Web rollout. Use for SDK dependency upgrades, official version checks, release-channel decisions, and runtime/repository cohort…