The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard development tools like uv, pre-commit, and git to manage repository hooks. These operations are performed as part of the intended development workflow.
[EXTERNAL_DOWNLOADS]: The skill configures pre-commit to fetch hooks from well-known and reputable GitHub repositories, including astral-sh/ruff-pre-commit, pre-commit/pre-commit-hooks, and gitleaks/gitleaks. It explicitly instructs users to pin these references to specific tags or commit SHAs to ensure reproducibility and mitigate supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where project configuration files are read to determine tool versions.
Ingestion points: Reads pyproject.toml, .pre-commit-config.yaml, package.json, and .github/workflows/ (SKILL.md).
Boundary markers: None explicitly defined in templates.
Capability inventory: Executes uv run pre-commit install and uv run pre-commit run --all-files (SKILL.md).
Sanitization: Includes a dedicated linter scripts/check_precommit_config.py that validates the generated YAML configuration for security "footguns" and misconfigurations.

python-precommit