connect-query
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates a shell script (
scripts/connect-query-check.sh) designed to operate as a local git or IDE hook. The script uses standard tools likegrepandcatto analyze the contents of TypeScript files during the development workflow. - [INDIRECT_PROMPT_INJECTION]: The linting script processes user-generated code (untrusted input) to identify and block patterns that violate project standards. It includes a documented escape hatch (
// allow: direct-query) allowing developers to bypass checks for specific files when justified, which is a standard feature for linting tools. - [DYNAMIC_EXECUTION]: The shell script utilizes
sourceto load a helper library (_hook-lib.sh). This is a typical modular design for local shell scripts and is used to provide common hook functionality. - [SAFE]: The skill's instructions and references align with established best practices for the ConnectRPC and Protobuf ecosystems. It references legitimate, well-known libraries such as
@connectrpc/connect-queryand@bufbuild/protobuffor their intended purposes.
Audit Metadata