setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to install dependencies (husky, lint-staged, prettier), initialize Husky (npx husky init), and run scripts defined in package.json (typecheck, test). These are standard operations for repository maintenance.
- [INDIRECT_PROMPT_INJECTION]: The skill processes repository configuration files (package.json, lock files) and executes project scripts. 1. Ingestion points: package.json and lock files (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: npm install, npx husky init, npm run test, npm run typecheck (SKILL.md). 4. Sanitization: Absent. While this presents a theoretical attack surface if the repository is already malicious, it is the intended and expected behavior for this skill.
- [SAFE]: No signs of obfuscation, credential theft, or unauthorized persistence were found. The skill's behavior aligns with its stated purpose of setting up pre-commit hooks.
Audit Metadata