git-hooks-setup

The hook performs a legitimate lint-and-format workflow, and there is no clear evidence of intentional malware. However, direct interpolation of Git-controlled filenames into `execSync` shell commands creates command-injection and argument-injection risks. Filenames should be passed as safely separated arguments, shell execution should be avoided where possible, and `npx` should be constrained to trusted, pinned local tooling. The unused `fs` import is non-security-relevant.