verify-before-commit
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several standard development tools such as
npx,npm,go,git,grep, andechoto validate code quality and update logs. These are standard operations for a pre-commit hook automation. - [DYNAMIC_EXECUTION]: The skill executes Python scripts located within the local repository's
harness/directory (e.g.,qc-regression.py,task_lifecycle.py,code-logger.py). These appear to be internal project validators used for regression testing and task state management. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from the
llmwiki/directory, specifically moving draft files to permanent locations and updating index files. While it interacts with potentially untrusted data in these files, the actions are limited to structural movement and metadata updates rather than executing instructions found within the files.
Audit Metadata