setup-pre-commit

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using the detected package manager to install dependencies and initialize the Husky environment (e.g., npx husky init).
  • [PERSISTENCE]: The skill modifies the repository's git hooks by creating a .husky/pre-commit file. This ensures that linting and testing scripts run automatically whenever a commit is made. This behavior is the primary stated purpose of the skill.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs widely-used development tools (husky, lint-staged, prettier) from the official npm registry.
  • [INDIRECT_PROMPT_INJECTION]: The skill adapts its execution logic based on the contents of the repository's configuration files.
  • Ingestion points: Reads package.json and lock files (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lockb) to identify the project's environment.
  • Boundary markers: Not applicable for this specific workflow.
  • Capability inventory: File system write access for configuration, package installation via shell, and git commit execution.
  • Sanitization: The skill adapts to existing project scripts (typecheck/test) but does not perform explicit sanitization of the script names found in package.json.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 01:46 PM