1 file · 16 lines · 553 B
View on GitHub
- prevent-direct-push.json 16 lines · 553 B
prevent-direct-push.json
JSON
{
"description": "Prevent direct pushes to protected branches (main, develop). Blocks git push com..."
"hooks": {
"PreToolUse": [1 item]
}
}
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-17
3 observations
scanner score 42/100
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Tool Parameter AbuseTool Misuse · prevent-direct-push.py:16
- Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.MCP Least Privilege · SKILL.md:1
- subprocess module callDangerous Code Execution · prevent-direct-push.py:22
Learn more about NVIDIA SkillSpector or how components are reviewed.