setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the detected package manager to install dependencies, initialize Husky, and verify the setup through linting and tests.
- [EXTERNAL_DOWNLOADS]: It downloads well-known development tools including
husky,lint-staged, andprettierfrom the public package registry. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with the local repository's
package.jsonto execute user-defined scripts, representing a vulnerability surface where untrusted data could influence agent behavior. - Ingestion points: The skill reads the
package.jsonfile in the current working directory to determine which scripts to run (SKILL.md). - Boundary markers: No explicit delimiters or warnings are used to protect the agent from instructions embedded within the package configuration.
- Capability inventory: The agent performs shell command execution (installing packages, running scripts) and Git operations (SKILL.md).
- Sanitization: The skill does not perform validation or sanitization of the script content before execution.
Audit Metadata