skills/bmsuisse/skills/prek/Gen Agent Trust Hub

prek

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the prek binary from its official GitHub releases (github.com/j178/prek/releases) using the uv tool manager.
  • [REMOTE_CODE_EXECUTION]: The prek.toml configuration utilizes remote hook repositories, specifically astral-sh/ruff-pre-commit, which involves downloading and executing third-party code during the git commit lifecycle.
  • [COMMAND_EXECUTION]: The skill invokes various system commands to verify tool versions, discover project files using find, and execute formatters like ruff, sqlfmt, and biome via uv and bunx.
  • [PERSISTENCE]: The skill uses prek install to write a hook into the repository's .git/hooks/pre-commit directory, ensuring that the configured quality checks run automatically on every code commit.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a local utility, scripts/check_files.py, for scanning project files.
  • Ingestion points: The script reads file contents from the project directory provided via command-line arguments.
  • Boundary markers: No markers or explicit warnings are used to delimit content within the scanned files.
  • Capability inventory: The script can terminate the commit process via exit codes and output messages to the terminal.
  • Sanitization: The script performs no sanitization or escaping of file content before applying regex pattern matching.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 08:47 AM