Skip to content
Back to skills

Commit Message Review

ASecurity

Use when reviewing any Gerrit change or PR that has a commit message, verifies the message against the diff: claim/code mismatches (message says fix, diff adds a feature), unmentioned user-visible behavior changes, vague messages on non-trivial diffs, implausible ticket or issue ids. Fires on every review where a commit message is visible.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 5, 2026
code-qualityrustgoapi

Works with

  • api

Security analysis

A100/100

Pro scans all 8 files and shows the line behind each finding

Scanned November 5, 2026

npx -y skills add gvago/unofficial-qodo-review-skills --skill commit-message-review --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Commit Message Review?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Commit Message Review
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/gvago-commit-message-review/badge)](https://www.skillsdirectory.com/skills/gvago-commit-message-review)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: commit-message-review
description: "Use when reviewing any Gerrit change or PR that has a commit message, verifies the message against the diff: claim/code mismatches (message says fix, diff adds a feature), unmentioned user-visible behavior changes, vague messages on non-trivial diffs, implausible ticket or issue ids. Fires on every review where a commit message is visible."
license: Apache-2.0
metadata:
  author: gvago
  variant: review
  version: 1.0.0
---

# commit-message-review

Lens that verifies the commit message against the diff. Runs no tools.
Trust nothing the message says until the diff proves it.

## Boundaries

- Judge only the relationship between the commit message and the changed
  lines. Code correctness, style, and design belong to other lenses.
- Gerrit has no inline anchoring on the commit message pseudo-file yet.
  Anchor every finding on a changed line in the diff that demonstrates
  the mismatch, and quote the offending message text in the finding body.
- Do not flag wording, grammar, tense, or formatting of the message when
  its content is accurate.

## How to apply

1. Read the full commit message: subject, body, and trailers (Fixes:,
   Bug:, Issue:, ticket ids).
2. Read the whole diff and list what it actually does: fixes, features,
   refactors, behavior changes, interface changes.
3. Compare the two lists and apply the rule index.

## Rule index

- M1. Claim/diff match. Every claim in the message must match what the
  diff actually does. Flag mismatches: the message says fix but the diff
  adds a feature, the message describes a change the diff does not
  contain, or the diff does something major that the message frames as
  something else.
- M2. Behavior coverage. The message must mention every user-visible
  behavior change present in the diff: changed defaults, removed or
  renamed flags and options, altered output or error handling, new or
  removed endpoints or commands. An unmentioned behavior change is a
  finding even when the rest of the message is accurate.
- M3. No vague messages on non-trivial diffs. Messages like "fix stuff",
  "update code", "misc changes", or a bare file name are findings when
  the diff is non-trivial (more than a rename, a comment edit, or a
  one-line mechanical change).
- M4. Ticket plausibility. A referenced ticket or issue id must be
  plausible for the change scope: the project prefix and the subject the
  message attributes to it should fit the code being touched. Flag ids
  whose stated subject or project clearly does not match the diff. Do
  not demand tracker access; judge plausibility from message and diff
  alone.

## Mapping a finding to the contract

- action_level: action_required for a proven M1 mismatch that would
  mislead a reader about what shipped; remediation_recommended for M2,
  M3, and M4.
- category: Correctness for M1, Maintainability for M2 to M4.
- evidence: quote the message text and cite the changed file and line
  that contradicts it or is missing from it. Anchor on the change
  itself, never on the commit message pseudo-file.

## What NOT to flag

- Accurate but terse messages on trivial diffs.
- Message style, capitalization, or line-length conventions.
- Claims about motivation or external context that the diff cannot
  verify either way.

Files in this skill

  • SKILL.md3.2 KB
  • evals/clean/change.patch443 B
  • evals/clean/commit_message.txt312 B
  • evals/evals.json1.8 KB
  • evals/mismatch/change.patch704 B
  • evals/mismatch/commit_message.txt220 B
  • evals/vague/change.patch919 B
  • evals/vague/commit_message.txt12 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.