Skip to content
skillsafebeta
← Report library
Purpose / Other

Setup Pre Commit Skill Security Audit

What the author says it does (original text)

Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Staging and committing every change can put unrelated files or secrets into Git history

Source references: 2
What we found

Beyond configuring hooks, the Skill explicitly directs the agent to stage “all” changed or created files and make a commit. Before that commit, a wildcard rule rewrites every supported staged file with Prettier. It does not first constrain the file set or require confirmation of the commit contents.

Why this matters

Existing work, generated files, credential files, or other sensitive content could be included with the hook configuration, while Prettier may add unrelated formatting changes. Deleted secrets can remain in Git history and may be exposed if the commit is later pushed.

Two active instructions create the risk: lint-staged rewrites every staged file that Prettier can parse, and the Skill then directs staging all changed or newly created files and committing immediately. If the working tree already contains unrelated edits, generated files, or secrets, they could enter Git history; supported staged files may also be reformatted. A user can restrict staging to this Skill's configuration files and require review of the staged diff and secret checks before committing.

SKILL.md:49In the instructionsOpen original file
### 5. Create `.lintstagedrc````json{  "*": "prettier --ignore-unknown --write"}```
Show 1 other places
SKILL.md:81In the instructionsOpen original file
### 8. CommitStage all changed/created files and commit with message: `Add pre-commit hooks (husky + lint-staged + prettier)`This will run through the new pre-commit hooks: a good smoke test that everything works.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 7
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The workflow first installs dev dependencies without pinned versions and then runs `npx husky init`. A first-time setup may therefore obtain a Husky release that changes over time and execute its initialization code. This is consistent with the stated setup purpose, but creates reproducibility and dependency supply-chain risk. A user can ask that the lockfile be honored, major versions be pinned, and resolved versions be reviewed before installation.

Legitimate use of this code

Here, `npx lint-staged` invokes the tool from a pre-commit hook after the workflow has already installed lint-staged as a dev dependency; the cited line does not itself explicitly request an installation. The earlier dependency installation is unpinned, but line 42 is an ordinary execution command. A temporary download would be possible only if the local dependency were absent and `npx` were allowed to fetch it.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
Legitimate use of this code

Line 79 verifies that the already-installed lint-staged tool works; it is not an explicit installation step. The instructions first add lint-staged as a dev dependency, so `npx` would normally use the repository-local version. An additional download is possible only if the dependency is missing and automatic fetching is allowed. The unpinned-version concern belongs to the earlier installation instruction, not this verification command itself.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:32In the instructionsOpen original file
```bashnpx husky init```
Show 6 other places
SKILL.md:23In the instructionsOpen original file
Install as devDependencies:```husky lint-staged prettier```
SKILL.md:31In the instructionsOpen original file
```bashnpx husky init```
SKILL.md:42In the instructionsOpen original file
```npx lint-stagednpm run typecheck
SKILL.md:39In the instructionsOpen original file
Write this file (no shebang needed for Husky v9+):```npx lint-stagednpm run typechecknpm run test```
SKILL.md:79In the instructionsOpen original file
- [ ] `prettier` config exists- [ ] Run `npx lint-staged` to verify it works
SKILL.md:73In the instructionsOpen original file
### 7. Verify- [ ] `.husky/pre-commit` exists and is executable- [ ] `.lintstagedrc` exists- [ ] `prepare` script in package.json is `"husky"`- [ ] `prettier` config exists- [ ] Run `npx lint-staged` to verify it works
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

The Skill installs Husky, lint-staged, and Prettier, then initializes Husky; this changes project dependencies and package.json and creates a .husky directory.

View source
SKILL.md:21In the instructionsOpen original file
### 2. Install dependenciesInstall as devDependencies:```husky lint-staged prettier```
SKILL.md:29In the instructionsOpen original file
### 3. Initialize Husky```bashnpx husky init```This creates `.husky/` dir and adds `prepare: "husky"` to package.json.

The generated commit hook first rewrites every staged file supported by Prettier, then runs the project's full typecheck and test commands. These commands are triggered on every commit.

View source
SKILL.md:41In the instructionsOpen original file
```npx lint-stagednpm run typechecknpm run test```
SKILL.md:51In the instructionsOpen original file
```json{  "*": "prettier --ignore-unknown --write"}```
SKILL.md:89In the instructionsOpen original file
- Husky v9+ doesn't need shebangs in hook files- `prettier --ignore-unknown` skips files Prettier can't parse (images, etc.)- The pre-commit runs lint-staged first (fast, staged-only), then full typecheck and tests
Start here · InstructionsSKILL.md
setup-pre-commit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:31In the instructionsOpen original file
```bashnpx husky init
Install extra software packages
SKILL.md:32In the instructionsOpen original file
```bashnpx husky init```
SKILL.md:42In the instructionsOpen original file
```npx lint-stagednpm run typecheck
SKILL.md:79In the instructionsOpen original file
- [ ] `prettier` config exists- [ ] Run `npx lint-staged` to verify it works
Lines read
96
File checksum (to compare versions)
c3aede8940c4ed9a9425540a2f07d2ded899ebda127035c01c0ab2c71a74de29