setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to manage Node.js packages and project workflows. It uses detected package managers (npm, pnpm, yarn, or bun) to install 'husky', 'lint-staged', and 'prettier' as development dependencies. It also runs 'npx husky init' to initialize the hook system and executes 'typecheck' and 'test' scripts during the verification phase.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon data from local project files. Specifically, it reads 'package.json' to identify and execute user-defined scripts.
- Ingestion points: 'package.json' (scripts section) and lockfiles (e.g., 'package-lock.json').
- Boundary markers: Absent.
- Capability inventory: File system writes (creating config files), package installation, and execution of arbitrary project scripts ('npm run test', 'npm run typecheck').
- Sanitization: None; the skill assumes the project's 'package.json' contains legitimate scripts.
Audit Metadata