setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes package manager commands (npm, yarn, pnpm, or bun) to install developer tools and initialize Husky. Evidence includes instructions to run
npm install,npx husky init, andnpx lint-stagedas part of the setup process in SKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files to adapt its setup logic, creating a surface for indirect instructions if those files are externally influenced.\n - Ingestion points: Reads
package.jsonand lockfiles (package-lock.json,pnpm-lock.yaml,yarn.lock,bun.lockb) to detect the environment (SKILL.md).\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within these files.\n
- Capability inventory: The skill can execute shell commands, install packages, and write files to the repository.\n
- Sanitization: There is no evidence of sanitization or validation of the data retrieved from the project files.
Audit Metadata