pre-push
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for code validation, such as
npm run lint,npm test,cargo build, andgo test. These commands are consistent with the skill's primary purpose of running pre-push checks. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through local project configuration files.
- Ingestion points: Reads data from
package.json,pyproject.toml,Cargo.toml, andgo.modfiles. - Boundary markers: Absent. The skill does not use delimiters or instructions to ignore malicious embedded content in these files.
- Capability inventory: Possesses significant capabilities to execute shell commands across several runtimes (Node.js, Python, Rust, Go).
- Sanitization: Absent. Commands and scripts extracted from configuration files are executed without sanitization or validation.
- [EXTERNAL_DOWNLOADS]: The use of
npxand package manager commands may trigger downloads of missing dependencies from official registries like npmjs.com. These are standard developer operations and target well-known repositories.
Audit Metadata