commitgate@0.2.0

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

User runs npx commitgate or added req:* scripts with --run

Creates workflow files and metadata in the target git repo; no unconsented install-time behavior or exfiltration observed.

package-aligned scaffolding and review/commit automation

Static inspection shows risky primitives are user-invoked and aligned with a commit-gate workflow, with no lifecycle hook, hidden network exfiltration, or unconsented AI-agent control mutation. The scanner's dangerous delta is explained by the CLI scaffolder and subprocess adapter implementation.