setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and adapts to existing repository content, creating an attack surface where malicious data in project files could influence agent behavior.
- Ingestion points: The agent reads
package.json,package-lock.json,yarn.lock,pnpm-lock.yaml, andbun.lockbto detect the package manager and available scripts. - Boundary markers: No explicit delimiters or instructions are used to distinguish between repo data and the skill's instructions.
- Capability inventory: The skill can install npm packages, write configuration files, modify the
package.jsonfile, and perform git commits. - Sanitization: No sanitization or validation of the ingested repository metadata is performed before usage.
- [COMMAND_EXECUTION]: The skill executes standard development commands to initialize the environment.
- Evidence: Uses
npx husky init, package manager installation commands (npm, yarn, pnpm, bun), andgit committo verify the setup.
Audit Metadata