Skills commit-chat-push
๐Ÿ“ฆ

commit-chat-push

Content revision r2 High Risk โš™๏ธ External commands๐ŸŒ Network access๐Ÿ“ Filesystem access

Commit Code With a Reviewed Codex Transcript

Implementation context is often lost after code is committed. This workflow guides transcript review, selective staging, commit creation, and branch publication.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "commit-chat-push" from https://skillstore.io/skills/bertona88-commit-chat-push.md and its manifest at https://skillstore.io/api/skills/bertona88-commit-chat-push/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "commit-chat-push". Commit this feature with the Codex transcript and push it.

Expected outcome:

  • Reviewed the repository diff and excluded unrelated files.
  • Prepared and scanned the selected transcript before staging.
  • Committed the intended files and pushed the current branch.

Using "commit-chat-push". Include provenance, but do not expose command output.

Expected outcome:

Prepared the transcript with command output omitted, reviewed it for sensitive text, and included it with the selected changes.

Using "commit-chat-push". The branch has no upstream. Publish the reviewed commit.

Expected outcome:

Verified the configured remote, created the commit, established the branch upstream, and reported the push result.

Security Audit

High Risk
v6 โ€ข 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks, code fences, safe Git inspection commands, and defensive secret-search patterns. Confirmed risks include reading private Codex sessions, permitting raw-session commits, and pushing transcript content to a remote repository. The referenced redaction exporter is missing, so its privacy controls cannot be audited.

3
Files scanned
220
Lines analyzed
9
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Session Transcript Publication Can Expose Sensitive Data
The workflow exports private Codex session content, adds the transcript to a commit, and pushes it. Redaction is explicitly described as incomplete.
The skill directly combines session export, transcript staging, and git push while warning that sessions can contain secrets and private instructions.
Medium
Security-Critical Exporter Is Missing From the Audited Package
The documentation invokes an exporter as the redaction boundary, but its implementation is absent from the three audited files. Redaction and session selection cannot be verified.
Both documentation files reference scripts/export_codex_session.py, while the audited package contains only .gitignore, README.md, and SKILL.md.
Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Hidden file in home directory
Commit Chat Push is a Codex skill for shipping code with its implementation provenance. It guides Co
The description explicitly reads Codex sessions under the hidden home directory and prepares their contents for a repository commit.
High
Hidden file in home directory
description: Commit and push repository changes while also exporting and committing the Codex chat/s
The trigger description explicitly directs access to Codex sessions under ~/.codex and includes their exported content in a commit.
High
Hidden file in home directory
- Do not commit raw `~/.codex/sessions/*.jsonl` unless the user explicitly asks for raw logs after b
The workflow permits committing raw session JSONL after a warning. Those files can contain secrets, private prompts, and full tool output.
Medium
Hidden file access
Commit Chat Push is a Codex skill for shipping code with its implementation provenance. It guides Co
The advertised workflow accesses private Codex session data under ~/.codex and exports it into source control.
Medium
Ruby/shell backtick execution
```bash
The block instructs execution of a Python helper that processes private Codex session data and writes an export. The helper implementation is absent from the audit.
Medium
Ruby/shell backtick execution
- If the branch already has an upstream, run `git push`.
The instruction runs git push, which transmits the staged code and transcript to the configured remote repository.
Medium
Ruby/shell backtick execution
- If it does not and a default remote exists, run `git push -u origin HEAD`.
The instruction runs git push with upstream creation, causing an external repository mutation and possible transcript disclosure.
Medium
Hidden file access
description: Commit and push repository changes while also exporting and committing the Codex chat/s
The advertised workflow reads private session records from the hidden Codex home directory for publication.
Medium
Hidden file access
- Do not commit raw `~/.codex/sessions/*.jsonl` unless the user explicitly asks for raw logs after b
The line allows raw ~/.codex session files to enter source control after user confirmation, retaining substantial disclosure risk.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/bertona88-commit-chat-push/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/bertona88-commit-chat-push/security.svg)](https://skillstore.io/skills/bertona88-commit-chat-push?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/bertona88-commit-chat-push?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bertona88-commit-chat-push/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/bertona88-commit-chat-push.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

bertona88. (2026). commit-chat-push security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/bertona88-commit-chat-push/audits/6

BibTeX citation

@techreport{bertona88-bertona88-commit-chat-push-2026, author = {bertona88}, title = {commit-chat-push security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/bertona88-commit-chat-push/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "commit-chat-push security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "bertona88" date-released: "2026-07-23" url: "https://skillstore.io/skills/bertona88-commit-chat-push/audits/6" identifiers: - type: other value: "skillstore:bertona88-commit-chat-push:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Preserve Feature Provenance

Commit a reviewed implementation transcript beside a completed feature for future maintenance.

Document Assisted Changes

Record selected development context for reviewers who need to understand how a change was produced.

Standardize Repository Handoffs

Apply consistent checks before staging code, attaching a transcript, creating a commit, and pushing.

Try These Prompts

Commit Completed Work
Use commit-chat-push to review my current changes, include a redacted Codex transcript, commit the intended files, and push the branch.
Commit With Focused Verification
Review the diff, run the narrowest relevant tests, export the anchored session, scan it for secrets, then commit and push.
Respect Existing Transcript Conventions
Find this repository's transcript convention, export the current anchored session there, exclude unrelated changes, show the staged diff, then commit and push.
Prepare a Controlled Provenance Commit
Inspect the remote and upstream, verify the change, review the redacted transcript, stage explicit paths, summarize exposure risks, request confirmation, then push.

Best Practices

  • Review the selected transcript and staged diff immediately before committing.
  • Keep command output disabled unless every included result has been checked.
  • Confirm the destination remote and branch before publishing transcript content.

Avoid

  • Do not stage every dirty file when unrelated changes are present.
  • Do not commit raw Codex session JSONL files.
  • Do not force-push unless the user explicitly requests and understands it.

Frequently Asked Questions

What does this skill add to a commit?
It guides adding selected repository changes and a reviewed Markdown transcript of the Codex session.
Does it include the transcript exporter?
No. The audited package references an exporter script, but that script is absent.
Can transcript redaction remove every secret?
No. The documentation requires manual review and a secret scan before committing.
How does it choose the current session?
The documented workflow creates a unique anchor and requires the selected session to contain it.
Will it commit unrelated working-tree changes?
The instructions require explicit pathspecs and staged-diff review when unrelated changes exist.
Does it force-push rejected changes?
No. It directs normal synchronization and requires an explicit user request before any force push.

Developer Details

Author

bertona88

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

8c3e20bba512c392d9b02ee748b18e0b09d4982c

Maintenance freshness

7/24/2026

Usage

2 downloads ยท 73 views

File structure

๐Ÿ“„ .gitignore

๐Ÿ“„ README.md

๐Ÿ“„ SKILL.md

View all