prek
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through the
prekCLI, including subcommands likeprek run,prek install, andprek validate-config. - [COMMAND_EXECUTION]: The documentation provides examples of 'system' hooks that execute arbitrary local commands (e.g.,
just lint-md) as part of the pre-commit workflow. - [EXTERNAL_DOWNLOADS]: The skill refers to external sources for tool installation, including official package registries (npm, cargo) and GitHub repositories (j178/prek-action).
- [INDIRECT_PROMPT_INJECTION]: The skill operates on repository configuration files (
prek.toml,.pre-commit-config.yaml). - Ingestion points: Reads hook definitions from local configuration files.
- Boundary markers: None present; the agent is instructed to trust and validate these files.
- Capability inventory: The tool can execute any command defined in the configuration's
entryfield viaprek run. - Sanitization: None; the skill relies on the user or the
prek validate-configcommand to ensure configuration integrity.
Audit Metadata