precommit-setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.9.19

Overview

This skill is a disclosed pre-commit setup guide with expected repo-local hook and CI behavior, though users should review its generated hooks and mutable third-party dependencies before adopting it.

Install only if you want repository pre-commit hooks that run automatically on commits. Review the hook list, pin third-party hook and CI dependencies more tightly if your project requires stronger supply-chain control, and run cache-clearing commands only from the intended repository root.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: modules/ci-integration.md:33

Finding

Unpinned Package Installation and Mutable GitHub Action Reference in CI

Content

View full analysis

Vulnerability Details

File Location: modules/ci-integration.md:33-45
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

yaml

      - name: Install uv
        run: pip install uv

      - name: Install dependencies
        run: uv sync

      - name: Run Comprehensive Quality Checks
        run: ./scripts/check-all-quality.sh

      - name: Upload Coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage.xml

Technical Analysis

The CI example installs uv without an explicit version or package hash. Consequently, pip install uv resolves whichever release is current when the workflow runs. The workflow also references codecov/codecov-action@v4, which is a mutable major-version tag rather than an immutable commit SHA.

Both dependencies execute code inside the CI runner. Their effective implementations can therefore change after this Skill has been reviewed, without any corresponding change to the repository. A compromised package release, package registry account, GitHub repository, release process, or mutable action tag could cause attacker-controlled code to execute during a subsequent workflow run.

There is no evidence that the currently referenced uv package or Codecov action is malicious. The vulnerability is the lack of immutable dependency verification.

Attack Path

1. An attacker compromises the relevant package publication account, GitHub repository, release process, or mutable action tag.
2. The attacker publishes a malicious uv release or redirects the v4 action tag to a malicious commit.
3. A user adopts the documented workflow and triggers it through a push or pull request.
4. The CI runner downloads and executes the modified dependency.
5. The malicious dependency accesses data and permissions available to that workflow, subject to the runner configu ...[truncated 714 chars]

Remediation

View remediation

Remediation Suggestions

• Pin uv to a specifically reviewed version rather than installing the latest release.
• Install Python packages from a hash-locked requirements file using hash verification.
• Pin codecov/codecov-action to a reviewed full commit SHA.
• Retain the release version in a comment beside the SHA for maintainability.
• Commit and enforce the dependency lockfile used by uv sync.
• Grant the workflow only the minimum required GITHUB_TOKEN permissions.
• Use automated dependency-update tooling to propose reviewed changes to versions, hashes, and action SHAs.
• Protect CI environments and avoid exposing secrets to untrusted pull-request workflows.

T08 · Insecure Dependencies

Warning

• Location: modules/standard-hooks.md:28

Finding

Mutable Pre-commit Hook Dependencies Execute Unverified Upstream Code

Content

View full analysis

Vulnerability Details

File Location: modules/standard-hooks.md:28-54; duplicated in modules/ci-integration.md:54-80
Vulnerability Type: Mutable third-party pre-commit dependencies
Risk Level: Medium

Vulnerable Code

yaml

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: check-toml
      - id: check-json

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.14.2
    hooks:
      - id: ruff
        args: [--fix]
      - id: ruff-format

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.13.0
    hooks:
      - id: mypy
        args: [--ignore-missing-imports]

  - repo: https://github.com/PyCQA/bandit
    rev: 1.8.3
    hooks:
      - id: bandit
        args: [-c, pyproject.toml]

Technical Analysis

The documented pre-commit configuration retrieves executable hooks from external Git repositories and identifies their revisions using release tags. Tags are not cryptographically immutable references: an upstream maintainer or compromised account may delete and recreate a tag so that it points to different code.

Pre-commit downloads the specified repositories, creates hook environments, installs their dependencies, and executes their hook entry points. Consequently, changing a referenced tag upstream can alter the code that runs on developer machines or CI systems even when the local configuration remains unchanged.

The same vulnerable configuration is reproduced in modules/ci-integration.md:54-80, extending the exposure to the complete CI example. No evidence indicates that the currently referenced repositories or releases are malicious.

Attack Path

1. An attacker compromises one of the referenced upstream repositories, maintainer accounts, release credentials, or dependency publication ...[truncated 1229 chars]

Remediation

View remediation

Remediation Suggestions

• Replace each tag in rev with a reviewed full Git commit SHA where supported.
• Document the corresponding human-readable release version next to each SHA.
• Apply the same immutable references to the duplicate configuration in modules/ci-integration.md.
• Review each hook repository's manifest, entry points, and transitive dependencies before approving updates.
• Use automated update tooling to submit explicit SHA changes for review rather than resolving mutable revisions during execution.
• Run hooks in isolated, least-privileged CI environments with narrowly scoped tokens.
• Periodically clear and rebuild hook environments from approved immutable revisions to avoid stale or unexpectedly altered installations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · modules/validation-hooks.md (reported line 50)May include surrounding context.

md

files: ^(plugins|src)/.*\\.py\$
\`\`\`

## Hook Bypass Policy

`SKIP=<hook> git commit` and `git commit --no-verify`
**must not be used**. Hooks exist to keep the tree

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · modules/validation-hooks.md (reported line 52)May include surrounding context.

md

## Hook Bypass Policy

`SKIP=<hook> git commit` and `git commit --no-verify`
**must not be used**. Hooks exist to keep the tree
green; bypassing them moves broken code into history,
where the next commit fights yesterday's bug instead

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad phrases such as "linting," "type-checking," "testing," and "setting up a new project or adding quality gates to an existing one," which can match many ordinary development requests outside the narrow need to configure pre-commit. That overbroad activation can cause the skill to be invoked in contexts where its instructions or generated commands are not appropriate, increasing the chance of unintended repository changes or confusing, excessive guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The load_when condition, project has multiple components or plugins, is a broad natural-language trigger for a markdown skill front matter and does not specify how that state is detected or when the skill should not load. Without explicit constraints or negative examples, the skill may activate in many common repository structures unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest field load_when: configuring base linters is broad natural language rather than a specific invocation condition. It does not define clear scope, exclusions, or concrete trigger phrases, so it could overlap with many general setup conversations and lead to unintended skill activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The load_when value hooks are slow or failing is broad natural language without clear scope, explicit trigger phrases, or exclusion conditions. Because it overlaps with common troubleshooting phrasing, it may match a wide range of ordinary user requests and activate the skill in unintended contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown instructs users to run find ... -exec rm -rf {} + commands that recursively delete cache directories. Although these are troubleshooting steps, the file does not explicitly warn that the commands remove files across the repository and should be reviewed before execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The load_when text says enforcing project conventions or schema rules, which is a broad natural-language condition without clear boundaries for when the skill should or should not activate. It does not provide specific trigger phrases, scope constraints, or exclusion conditions, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.