Caveman CommitSAFE
🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Terse Conventional Commits. Why over what.
What it does
Generates commit messages in Conventional Commits format. Subject ≤50 chars, hard cap 72. Imperative mood. Body only when the why is non-obvious or there are breaking changes. No AI attribution, no "this commit does X", no emoji unless the project uses them. Body always required for breaking changes, security fixes, data migrations, and reverts — future debuggers need the context.
Outputs only the message. Does not stage, commit, or amend.
How to invoke
/caveman-commit
Also triggers on phrases like "write a commit", "commit message", "generate commit".
Example output
Diff: new endpoint for user profile.
feat(api): add GET /users/:id/profile Mobile client needs profile data without the full user payload to reduce LTE bandwidth on cold-launch screens. Closes #128
Diff: breaking API rename.
feat(api)!: rename /v1/orders to /v1/checkout BREAKING CHANGE: clients on /v1/orders must migrate to /v1/checkout before 2026-06-01. Old route returns 410 after that date.
See also
SKILL.md— full LLM-facing instructions- Caveman README — repo overview
05e982541721OBSERVED · 2026-09-23Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: caveman-commit description: > Write a Conventional Commits message compressed to intent only. Use for "write a commit", "commit message", /commit or /caveman-commit. --- Write commit messages terse and exact. Conventional Commits format. No fluff. Why over what. ## Rules **Subject line:** - `<type>(<scope>): <imperative summary>` — `<scope>` optional - Types: `feat`, `fix`, `refactor`, `perf`, `docs`, `test`, `chore`, `build`, `ci`, `style`, `revert` - Imperative mood: "add", "fix", "remove" — not "added", "adds", "adding" - ≤50 chars when possible, hard cap 72 - No trailing period - Match project convention for capitalization after the colon **Body (only if needed):** - Skip entirely when subject is self-explanatory - Add body only for: non-obvious *why*, breaking changes, migration notes, linked issues - Wrap at 72 chars - Bullets `-` not `*` - Reference issues/PRs at end: `Closes #42`, `Refs #17` **What NEVER goes in:** - "This commit does X", "I", "we", "now", "currently" — the diff says what - "As requested by..." — use Co-authored-by trailer - "Generated with Claude Code" or any AI attribution — unless the user's own rule requires an `Assisted-by`/AI-attribution trailer, then add it as a trailer - Emoji (unless project convention requires) - Restating the file name when scope already says it ## Examples Diff: new endpoint for user profile with body explaining the why - ❌ "feat: add a new endpoint to get user profile information from the database" - ✅ ``` feat(api): add GET /users/:id/profile Mobile client needs profile data without the full user payload to reduce LTE bandwidth on cold-launch screens. Closes #128 ``` Diff: breaking API change - ✅ ``` feat(api)!: rename /v1/orders to /v1/checkout BREAKING CHANGE: clients on /v1/orders must migrate to /v1/checkout before 2026-06-01. Old route returns 410 after that date. ``` ## Auto-Clarity Always include body for: breaking changes, security fixes, data migrations, anything reverting a prior commit. Never compress these into subject-only — future debuggers need the context. ## Boundaries Only generates the commit message. Does not run `git commit`, does not stage files, does not amend. Output the message as a code block ready to paste. "stop caveman-commit" or "normal mode": revert to verbose commit style.
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
05e982541721full audit observations/trust-audit/skill/juliusbrussee__caveman-commit.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-23 | 05e982541721 | SAFE | B | 89 | first audit |
Questions
What does the Caveman Commit skill do?
🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
Is Caveman Commit safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Caveman Commit access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Caveman Commit work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (05e982541721), read on 2026-09-23. The repository is watched, and a new audit runs when it changes — this is the first audit.