pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides examples of fetching installation scripts from external sources, specifically the official GitHub repository for tflint (terraform-linters). These references are standard for CI/CD pipeline setup for this tool.
- [COMMAND_EXECUTION]: The provided management tools (
Tools/PreCommitManager.tsandTools/HookValidator.ts) utilizeBun.spawnandBun.$to invoke thepre-commitcommand-line interface. This is the primary function of the skill—to automate code quality checks through the pre-commit framework. - [PRIVILEGE_ESCALATION]: CI/CD configuration examples in
Workflows/CIIntegration.mdinclude shell commands for package installation (apt-get) and moving binaries to system-wide directories (/usr/local/bin). These patterns are typical for environment provisioning in automated pipelines. - [INDIRECT_PROMPT_INJECTION]: The skill's ingestion points for untrusted data include
.pre-commit-config.yamland.pre-commit-hooks.yamlfiles within the project. While these files define the behavior of the agent when running hooks, they are a requirement for the pre-commit framework. The skill does not implement specific sanitization but relies on the pre-commit tool's own environment isolation.
Audit Metadata