py-git-hooks

Pass

Audited by Gen Agent Trust Hub on Mar 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill configures a PostToolUse hook in ~/.claude/settings.json that executes a shell command using environment variables. This represents a potential indirect injection surface if variables are not properly handled by the execution environment.
  • Ingestion points: Environment variables $PROJECT_DIR and $FILE_PATH referenced in the SKILL.md setup instructions for ~/.claude/settings.json.
  • Boundary markers: No explicit boundary markers or ignore-instruction warnings are present in the hook configuration.
  • Capability inventory: Subprocess execution via the Claude Code PostToolUse hook system (ruff check).
  • Sanitization: No sanitization or escaping is applied to the interpolated variables in the command string: cd "$PROJECT_DIR" && source .venv/bin/activate 2>/dev/null && ruff check "$FILE_PATH".
  • [EXTERNAL_DOWNLOADS]: Fetches hook configurations and executable code from well-known repositories on GitHub, specifically from Astral-sh (creators of Ruff) and the pre-commit project.
  • [EXTERNAL_DOWNLOADS]: Installs standard Python development tools including pre-commit, ruff, mypy, and basedpyright from the official PyPI registry using the uv package manager.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 2, 2026, 05:27 PM