生成 Git hooks 脚本，自动格式化代码、检查 lint、运行测试等。

This skill does not appear malicious, but it is inconsistent and incomplete. Before installing or running it: 1) Inspect git-hooks-generator.sh — it writes a .git/hooks/pre-commit that runs 'npm run lint' and 'npm test'. 2) Ensure you're in a git repository and back up any existing hooks (.git/hooks) so you don't overwrite them unintentionally. 3) Verify npm is available and review your repository's package.json scripts; those scripts will run with whatever commands they contain and could be destructive if they were malicious. 4) Note that the SKILL.md promises other hooks and a CLI ('git-hooks-generator add ...') but those are not implemented; ask the author for clarification or updated code. 5) If you want to proceed, test this in a safe or disposable repo first. If you need the additional advertised features (commit-msg, pre-push, multi-language), request an updated implementation that matches the documentation.

Type: OpenClaw Skill Name: git-hooks-generator Version: 1.0.0 The skill `git-hooks-generator` creates a Git pre-commit hook (`.git/hooks/pre-commit`) that executes `npm run lint` and `npm test`. While this aligns with the stated purpose of automating code quality checks, it introduces a vulnerability. The `npm run` commands execute arbitrary scripts defined in the project's `package.json`. If the `package.json` is compromised or contains malicious scripts, this skill would facilitate their execution without explicit sanitization or validation, leading to potential arbitrary code execution. This is a risky capability without clear malicious intent from the skill itself, classifying it as suspicious rather than malicious.