setup-pre-commit
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to execute standard development commands including dependency installation and tool initialization (e.g., 'npm install', 'npx husky init') using the project's detected package manager.
- [INDIRECT_PROMPT_INJECTION]: The skill relies on analyzing existing repository files to determine the project's configuration, which represents a potential attack surface if those files are maliciously crafted.
- Ingestion points: The agent is instructed to read 'package.json' and various lock files (e.g., 'package-lock.json', 'yarn.lock') to detect the package manager and available scripts.
- Boundary markers: No specific delimiters or security warnings are used when the agent processes the content of these files.
- Capability inventory: The skill possesses the capability to install packages, write configuration files, and execute scripts defined in the repository.
- Sanitization: The instructions include a conditional step to check for the existence of 'typecheck' and 'test' scripts in 'package.json' before adding them to the pre-commit hook, which serves as a validation mechanism to prevent executing non-existent or unintended commands.
Audit Metadata