The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs widely-used development dependencies including husky, lint-staged, and prettier from the public npm registry using the detected local package manager (npm, pnpm, yarn, or bun).
[COMMAND_EXECUTION]: Executes shell commands to initialize tools and install dependencies, such as npx husky init and package manager install commands. It also creates an executable shell script at .husky/pre-commit to run linting and testing tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes existing project files to adapt its behavior, which creates a potential surface for indirect instruction injection if the target repository contains malicious configuration.
Ingestion points: Reads package.json to detect existing typecheck and test scripts, and scans for specific lock files (package-lock.json, pnpm-lock.yaml, etc.) to identify the environment.
Boundary markers: None present; the skill assumes the structure of the repository configuration files is standard.
Capability inventory: The skill has permissions to write files (.husky/pre-commit, .lintstagedrc, .prettierrc), modify package.json, and execute shell commands through the system's package manager and npx.
Sanitization: No explicit sanitization or validation of the script names or contents retrieved from package.json is mentioned before they are incorporated into the pre-commit hook script.

setup-pre-commit