geemus/create-commit
.agents/skills/create-commit/SKILL.md
Stages changes safely, generates a conventional-commit message from the diff, and blocks secrets or debug artifacts from being committed. TRIGGER when: user asks to commit, save changes, stage files, write a commit message, run git commit, check in my changes, or commit my work. DO NOT TRIGGER when: user asks to push, open a PR, or create a branch.
development
Updated Apr 17, 2026
$ install --global
skillsauthnpx skillsauth add geemus/hax-yax create-commitInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 2:31 AM6.4s2 files scanned
SKILL.md
- name:
- create-commit
- description:
- >
- TRIGGER when:
- user asks to commit, save changes, stage files, write a commit
- DO NOT TRIGGER when:
- user asks to push, open a PR, or create a branch.
- license:
- Apache-2.0
- author:
- geemus
- version:
- 1.4
Create Commit
Guides agents through safe, well-formed git commits. Stages files automatically (skipping secrets and artifacts), generates a conventional-commit message from the diff, and confirms before committing.
Instructions
Side effects: stages files (git add), creates a git commit object. Does not push or open a PR.
1. Survey changes
git status
git diff
If git status shows no changes (clean working tree), stop and tell the user: "Nothing to commit — the working tree is clean."
Identify:
- Modified, added, and deleted tracked files
- Untracked files that are clearly part of the work (source files, config, docs in the project tree)
- Files to exclude: binaries, build artifacts, generated files (e.g.
dist/,*.pyc,node_modules/,*.min.js), lock files unless they changed intentionally
If the untracked file set is ambiguous (many files, files that look auto-generated, or files outside the project's normal structure), list them and ask the user which to include before proceeding.
2. Detect secrets
Before staging anything, scan all modified, added, and untracked files identified in step 1 for secret patterns. Read references/secret-patterns.md for the full pattern list.
If any match is found:
- Stop — do not stage the affected file
- Report the file path and the type of pattern matched
- Suggest remediation (remove the value, use an environment variable, add the file to
.gitignore) - Continue with the remaining safe files; do not abort the entire commit unless every file contains secrets
3. Stage automatically
Stage all safe files (those that passed step 2 and are not excluded artifacts) using individual git add <file> calls — never git add . or git add -A.
Report a brief summary:
- Staged: list of files
- Skipped: list of files with reason (secret detected / artifact / binary)
If nothing is staged after exclusions, stop and tell the user what was skipped and why.
4. Generate commit message
Read the staged diff:
git diff --cached
Derive the message following Conventional Commits:
<type>[optional scope]: <subject>
[optional body]
Type — pick the best fit:
feat: new feature or capabilityfix: bug fixdocs: documentation onlyrefactor: restructuring without behaviour changetest: adding or updating testschore: maintenance, tooling, dependencies
Scope — optional; use the skill name, component, or directory most affected (e.g. feat(plan):, fix(skills):).
Subject — lowercase imperative mood, no trailing period, ≤72 characters.
Body — include when the change is non-obvious: explain why, not what. Wrap at 72 characters.
5. Commit
Display the proposed commit message to the user, then immediately commit using a HEREDOC to avoid shell quoting issues:
git commit -m "$(cat <<'EOF'
<type>[scope]: <subject>
<body if any>
EOF
)"
Examples
Invocation:
/commit
Feature addition:
User has edited
.agents/skills/plan/SKILL.mdto add update mode.
feat(plan): add update mode for existing issues
Allows /plan to be invoked with an issue number or URL to edit an
existing issue in place rather than always creating a new one.
Bug fix:
User fixed a typo and a broken link in
AGENTS.md.
fix: correct typo and broken link in AGENTS.md
Secret detected — partial commit:
User runs
/commit; one file contains a hardcoded database password.
Staged: src/api/client.py, README.md
Skipped:
- config/local.env [BLOCKED: explicit secret assignment on line 4]
Fix: remove DB_PASSWORD value; reference $DB_PASSWORD instead,
or add config/local.env to .gitignore
Commit message:
feat(api): add client module
Related Skills
geemus/audit-skills
development
VerifiedTrustedCommunity
Produces a complete health report on a skill library: per-skill structural validation followed by cross-skill analysis covering trigger conflicts, redundancy, workflow coverage gaps, and composition chains. Auto-fixes unambiguous minor structural issues (whitespace, missing optional metadata) and formats all other findings with format-review-comments. TRIGGER when: user asks to audit skills, check skill coverage, validate all skills, find gaps in skills, check for trigger conflicts, or health-check the skill library. DO NOT TRIGGER when: user asks to create, update, rename, or delete a skill (use upsert-skill instead); or to evaluate a single skill for quality (use review-skill instead).
SKILL.mdUpdated Apr 17, 2026
openclaw/openclaw-secret-scanning-maintainer
development
VerifiedTrustedCommunity
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
357,764SKILL.mdUpdated Apr 15, 2026
openclaw/openclaw-release-maintainer
development
VerifiedTrustedCommunity
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/openclaw-qa-testing
development
VerifiedTrustedCommunity
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
357,764SKILL.mdUpdated Apr 10, 2026