setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the local package manager (npm, pnpm, yarn, or bun) to install devDependencies and executes
npx husky initto configure the Husky environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the repository's
package.jsonto detect existing scripts (typecheck,test) and lock files. While this is a data ingestion surface, it is used solely to adapt the configuration to the specific project context. - Ingestion points: Reads
package.jsonand project root for lock files (SKILL.md). - Boundary markers: None used when reading file contents.
- Capability inventory: Uses
npx,npm/yarn/pnpm/bunfor installation and execution; performs file writes for configuration files. - Sanitization: None; script names are used as found in the manifest.
Audit Metadata