git-hooks
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts and documentation for automating Git workflows using shell commands such as
git diff,git config, andbash -n. These operations are fundamental to the skill's purpose of managing Git hooks. - [DYNAMIC_EXECUTION]: The orchestrator script (
examples/modular-pre-commit/pre-commit) implements a modular pattern that finds and executes executable files within thehooks.d/directory. This dynamic execution is a documented feature of the skill's architecture. - [INDIRECT_PROMPT_INJECTION]: The skill's hook scripts ingest untrusted repository data including staged file content (via
git diff), commit messages (viacaton message files), and push metadata (viastdin). While the skill provides examples of capability execution (shell commands and network triggers), it also demonstrates sanitization patterns such as proper variable quoting and looping through file lists to mitigate common injection risks.
Audit Metadata