pre-commit

pre-commit

Invoked via /pre-commit. This skill acts as a pre-commit quality gate — it runs a fast subset of checks before committing and blocks the commit if critical issues are found. It can also install itself as a git hook.

Mode A — Run checks now (default)

When invoked without arguments, run immediately against staged files (or all modified files if nothing is staged):

1. Use Bash to get the list of files to check. git diff exits 0 even when it prints nothing, so an || fallback would never fire; test for empty output explicitly:

   FILES=$(git diff --cached --name-only --diff-filter=ACMR)
   if [ -z "$FILES" ]; then
     FILES=$(git diff --name-only --diff-filter=ACMR)
   fi
   printf '%s\n' "$FILES"
   

   If both lists are empty, report "Nothing staged or modified — nothing to check." and stop.

2. Secret scan — Use Grep across all staged files for hardcoded secret patterns:

   • Assignments (= or : — covers code, YAML, and JSON): (?i)(password|passwd|pwd|api_key|apikey|api_token|access_token|secret_key|client_secret|secret)\s*[=:]\s*['"][^'"]{8,}['"]
   • Shell exports: export\s+[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)[A-Z_]*=\S{8,}
   • AWS: (?i)(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*['"][^'"]{16,}['"] and literal AKIA[0-9A-Z]{16}
   • Modern token prefixes: sk-ant-, sk-proj-, github_pat_, ghp_, glpat- (GitLab), npm_ (npm), AIza (Google API key), xox[baprs]-, sk_live_
   • Private key headers: -----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----
   • High-entropy heuristic: any assignment of a 32+ char mixed-case alphanumeric literal to a variable whose name contains key, token, secret, or auth
   • Exclude: *.example, *.sample, node_modules/, vendor/
   • BLOCKER if found, except in test files (*.test.*, *.spec.*), where a match is a WARNING: fixtures usually hold fake values, but real credentials do get pasted into tests, so they are still scanned and reported. Report file and line number. When reporting, redact the matched value (show the first 4 characters only).