py-git-hooks
Warn
Audited by Snyk on Mar 2, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's required Step 2 instructs creating .pre-commit-config.yaml that pulls hook code from public GitHub repos (e.g., https://github.com/astral-sh/ruff-pre-commit and https://github.com/pre-commit/mirrors-mypy), which pre-commit will fetch and execute at runtime, allowing untrusted third‑party code to influence tool behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The .pre-commit-config.yaml references external hook repos (https://github.com/astral-sh/ruff-pre-commit and https://github.com/pre-commit/mirrors-mypy) which pre-commit will fetch at install/run time and execute as hooks, so they are runtime-fetched content that executes remote code.
Audit Metadata