prek

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The prek.j178.dev site and its GitHub releases page point to a personal account distributing binaries (downloadable executables via GitHub Releases), which is a higher-risk source compared to official vendor/package-manager distributions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The prek.toml includes a repo entry that will be fetched and executed at runtime by prek: "https://github.com/astral-sh/ruff-pre-commit" which can deliver and run hook code (ruff-check/ruff-format) when hooks are installed or run.