setup-pre-commit

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to install devDependencies using a detected package manager, initializes Husky via npx husky init, and performs a smoke test by running npx lint-staged and git commit.- [INDIRECT_PROMPT_INJECTION]: The skill analyzes the repository's package.json and lock files to determine existing scripts and the appropriate package manager, creating a surface for indirect instructions. * Ingestion points: Reads local package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, and bun.lockb. * Boundary markers: No specific delimiters or safety instructions are used when interpolating repository data into the execution flow. * Capability inventory: The skill has the ability to install packages, write new configuration files (.husky/pre-commit, .lintstagedrc, .prettierrc), modify package.json, and execute arbitrary repository scripts through the pre-commit hook. * Sanitization: The skill does not explicitly sanitize the contents of the package.json scripts before determining whether to include them in the pre-commit configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 03:09 AM
Security Audit — agent-trust-hub — setup-pre-commit