oh-precommit-codecheck
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches code analysis tools from Huawei's cloud infrastructure (myhuaweicloud.com). This includes the CodeArts engine and a custom clang-tidy binary which are essential for its operation.\n- [REMOTE_CODE_EXECUTION]: Executes the downloaded CodeArts engine (a Java JAR file) and a specialized clang-tidy binary locally to perform static analysis on the user's code.\n- [INDIRECT_PROMPT_INJECTION]:\n
- Ingestion points: Processes local source code files and the diagnostic output from tools like pylint, flake8, and shellcheck in the scripts/check.sh entry point.\n
- Boundary markers: Diagnostic results are parsed and passed directly to the agent without specific delimiters or instructions to ignore embedded content that might be present in the source files.\n
- Capability inventory: The agent is explicitly instructed to modify local files via the Edit tool to automatically 'fix' detected defects, which provides an attack surface if the diagnostic output is manipulated.\n
- Sanitization: No sanitization is performed on the diagnostic messages or the content of the analyzed files before they are presented to the agent's reasoning logic.
Audit Metadata