shared-tooling-git-hooks
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to configure Git hooks that execute shell commands (e.g.,
bunx lint-staged,bunx commitlint) during the development lifecycle. This is the intended behavior for Git hook automation tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the automated processing of external data which could potentially contain malicious instructions, though this is a standard risk for development workflow tools.\n - Ingestion points: Git commit messages are processed by the
commit-msghook (inSKILL.mdandexamples/core.md); staged file contents are processed by thepre-commithook vialint-staged(inSKILL.mdandexamples/core.md).\n - Boundary markers: No explicit instruction-level boundary markers or delimiters are defined for the processed data in
SKILL.md.\n - Capability inventory: The skill utilizes subprocess execution via
bunxto run linters, formatters, type checkers, and commit validators across all scripts (documented inSKILL.mdandexamples/core.md).\n - Sanitization: Input sanitization is deferred to the implementation of the third-party tools used.
Audit Metadata