We tested 5 AI commit-message skills on security. 3 made things worse.

We measured "lift" for 5 open-source Claude Code skills. Only 2 improved security outcomes over baseline — and the winner had zero security rules.