How is #precommit even a thing?
There's apparently _no_ security whatsoever. It just downloads random code from the internet and runs it on your machine.
And everyone with write access to the repo can just tell it to download _more_ code.
Compare this to direnv (https://direnv.net), which will ask you for permission every time someone changes its config.