setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to install devDependencies using a detected package manager, initializes Husky via
npx husky init, and performs a smoke test by runningnpx lint-stagedandgit commit.- [INDIRECT_PROMPT_INJECTION]: The skill analyzes the repository'spackage.jsonand lock files to determine existing scripts and the appropriate package manager, creating a surface for indirect instructions. * Ingestion points: Reads localpackage.json,package-lock.json,pnpm-lock.yaml,yarn.lock, andbun.lockb. * Boundary markers: No specific delimiters or safety instructions are used when interpolating repository data into the execution flow. * Capability inventory: The skill has the ability to install packages, write new configuration files (.husky/pre-commit,.lintstagedrc,.prettierrc), modifypackage.json, and execute arbitrary repository scripts through the pre-commit hook. * Sanitization: The skill does not explicitly sanitize the contents of thepackage.jsonscripts before determining whether to include them in the pre-commit configuration.
Audit Metadata