setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes package manager commands (
npm,pnpm,yarn,bun) to install dependencies and initialize tools. It specifically usesnpx husky initto set up the Husky environment and runsnpx lint-stagedfor verification. - [EXTERNAL_DOWNLOADS]: The skill installs three external Node.js packages (
husky,lint-staged,prettier) from the public npm registry. These are well-known, widely-used development utilities. - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it reads existing repository configuration files, such as
package.jsonand various lockfiles (package-lock.json,yarn.lock, etc.), to determine the appropriate package manager and existing scripts. It includes instructions to adapt behavior based on the presence oftypecheckortestscripts.
Audit Metadata