pre-commit

pre-commit

Invoked via /pre-commit. This skill acts as a pre-commit quality gate — it runs a fast subset of checks before committing and blocks the commit if critical issues are found. It can also install itself as a git hook.

Mode A — Run checks now (default)

When invoked without arguments, run immediately against staged files (or all modified files if nothing is staged):

1. Use Bash to get the list of files to check:

   git diff --cached --name-only 2>/dev/null || git diff --name-only
   

2. Secret scan — Use Grep across all staged files for hardcoded secret patterns:

   • Assignments (= or : — covers code, YAML, and JSON): (?i)(password|passwd|pwd|api_key|apikey|api_token|access_token|secret_key|client_secret|secret)\s*[=:]\s*['"][^'"]{8,}['"]
   • Shell exports: export\s+[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)[A-Z_]*=\S{8,}
   • AWS: (?i)(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*['"][^'"]{16,}['"] and literal AKIA[0-9A-Z]{16}
   • Modern token prefixes: sk-ant-, sk-proj-, github_pat_, ghp_, xox[baprs]-, sk_live_
   • Private key headers: -----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----
   • High-entropy heuristic: any assignment of a 32+ char mixed-case alphanumeric literal to a variable whose name contains key, token, secret, or auth
   • Exclude: *.example, *.sample, *.test.*, *.spec.*, node_modules/, vendor/
   • BLOCKER if found. Report file and line number. Do not commit. When reporting, redact the matched value (show the first 4 characters only).

3. Dead code scan — Use Grep across staged source files for:

   • ^\s*//.* blocks of 3+ consecutive commented-out code lines (not doc comments)
   • Common placeholder strings: TODO, FIXME, HACK, XXX, impl later, stub, placeholder
   • Exclude: *.md, *.txt, documentation files
   • WARNING (non-blocking) for TODO/FIXME; BLOCKER for stub/placeholder in non-test files.

4. Naming check — Use Read on each staged source file. Load naming conventions from CLAUDE.md if present (Grep for "naming" section). Apply:

   • Flag obvious violations: ALL_CAPS variable names outside constants, single-letter variables outside loop counters, names < 3 chars in function signatures
   • WARNING (non-blocking).