Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small Git hook generator whose repository-local automation is disclosed and purpose-aligned, though users should review the generated hook before enabling it.
Before installing, inspect the generated .git/hooks/pre-commit file and make sure you are comfortable with it overwriting any existing pre-commit hook and running your repository's npm lint and test scripts on future commits.
The skill advertises shell-capable behavior for generating and likely installing Git hook scripts, but it does not declare any tool scope such as permissions or allowed-tools. That omission makes the skill less transparent and reduces containment, increasing the risk that an agent could invoke shell actions affecting a repository without an explicit capability boundary.
The natural-language description and feature summary force a specific language for users without indicating that the skill is region-specific or providing an opt-in choice. This can violate language or locale policy when a skill imposes one language by default.
The skill description does not warn users that it generates and installs Git hooks, which can automatically run code on commit, commit-msg, or push and alter repository behavior. While this is primarily a transparency and safety issue rather than direct exploit code, hidden automation can surprise users and lead to unintended command execution in developer workflows.
The manifest description is written as a directive in Chinese ('生成 Git hooks 脚本'), which indicates the skill is described for a specific language/locale without any visible user choice or documented regional justification. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern.
