setup-git-hooks
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill scaffolds Git hooks designed to execute shell commands and local development tools (e.g.,
make,gofmt,git) during Git events such aspre-commitandpre-push. - [DYNAMIC_EXECUTION]: The system includes an
auto_update_hooksfunction incommon.shthat automatically runs theinstall-hooks.shscript if it detects changes to thehooks/directory within the Git history after a checkout, merge, or rewrite. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository files to decide default lint and test commands, creating an attack surface for instructions embedded in project metadata. \n
- Ingestion points:
go.mod,package.json,Cargo.toml,Gemfile,pyproject.toml,Makefile,.golangci.yml,.eslintrc*,.prettierrc*. \n - Boundary markers: The process includes a mandatory step to present findings and confirm the directory tree and file contents with the user before writing. \n
- Capability inventory: Shell script execution (
chmod,ln,git config) and execution of repository-defined build/test commands. \n - Sanitization: No specific data sanitization is mentioned; the skill relies on user verification of the generated scripts.
Audit Metadata