setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
husky,lint-staged, andprettierpackages using the project's detected package manager (npm, pnpm, yarn, or bun). - [COMMAND_EXECUTION]: Several shell commands are executed to initialize the Husky environment (
npx husky init) and verify the setup through a test commit. - [DYNAMIC_EXECUTION]: The skill generates a shell script for the pre-commit hook at
.husky/pre-commitand subsequently triggers its execution by performing a git commit operation as a smoke test. - [INDIRECT_PROMPT_INJECTION]: The skill reads repository lock files to determine the environment and writes multiple configuration files to the filesystem.
- Ingestion points: Detection of
package-lock.json,pnpm-lock.yaml,yarn.lock, orbun.lockbto determine the package manager. - Boundary markers: None present in the file write or detection steps.
- Capability inventory: The skill utilizes file system write access, package installation, and shell command execution via the terminal.
- Sanitization: No explicit sanitization or validation of the repository's existing files is performed before processing.
Audit Metadata