Borrowing it
Nothing to install: this file belongs to T-rav/hydraflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/T-rav/hydraflow/staging/.codex/skills/hf.validate-tests-before-commit/SKILL.mdgit clone --depth 1 https://github.com/T-rav/hydraflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/t-rav/hydraflow/hf.validate-tests-before-commit)<a href="https://agentmods.dev/skills/t-rav/hydraflow/hf.validate-tests-before-commit"><img src="https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.validate-tests-before-commit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/t-rav/hydraflow/hf.validate-tests-before-commit"><img src="https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.validate-tests-before-commit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00013 | $0.01364 |
| Opus 5.5 | $0.00005 | $0.00546 |
| Sonnet 5.5 | $0.00003 | $0.00273 |
| Haiku 4.5 | $0.00001 | $0.00136 |
Grade C, and why
hf.validate-tests-before-commit scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
echo "BLOCKED: uv is not installed. Install it: curl -LsSf https://astral.sh/uv/install.sh | sh" >&2 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
echo "BLOCKED: uv is not installed. Install it: curl -LsSf https://astral.sh/uv/install.sh | sh" >&2 How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hf.validate-tests-before-commit
#!/bin/bash
# Hook: Validate tests exist for staged changes and pass before allowing commit.
# Fires on PreToolUse for Bash commands matching git commit.
# Blocks commit if:
# 1. --no-verify or --no-hooks flags are used
# 2. Python source files are staged without corresponding test files
# 3. Tests for affected services fail
set -euo pipefail
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
CWD=$(echo "$INPUT" | jq -r '.cwd // empty')
# Only intercept git commit commands
if ! echo "$COMMAND" | grep -qE '(^|\s|&&\s*|;\s*)git commit'; then
exit 0
fi
# Block --no-verify / --no-hooks (forbidden per CLAUDE.md)
if echo "$COMMAND" | grep -qE '\-\-no-verify|\-\-no-hooks'; then
echo "BLOCKED: --no-verify and --no-hooks are forbidden per CLAUDE.md." >&2
echo "Fix code issues first, then commit cleanly." >&2
exit 2
fi
# Resolve project root from git toplevel (CWD may be a subdirectory)
PROJECT_ROOT=$(git -C "$CWD" rev-parse --show-toplevel 2>/dev/null || echo "$CWD")
cd "$PROJECT_ROOT"
# Get staged files early — skip expensive checks for non-source commits
STAGED_FILES=$(git diff --cached --name-only 2>/dev/null || true)
if [ -z "$STAGED_FILES" ]; then
exit 0 # Nothing staged, let git handle it
fi
# Fast exit: if no source code is staged, skip lint and tests entirely
HAS_SOURCE=$(echo "$STAGED_FILES" | grep -E '\.(py|ts|tsx|js|jsx)$' || true)
if [ -z "$HAS_SOURCE" ]; then
exit 0 # Config/docs/YAML/Dockerfile-only commit, no lint or test needed
fi
# Require uv for running Python
if ! command -v uv &>/dev/null; then
echo "BLOCKED: uv is not installed. Install it: curl -LsSf https://astral.sh/uv/install.sh | sh" >&2
exit 2
fi
# Run lint checks (only reached for commits with source code)
echo "Running lint checks..." >&2
if ! make -C "$PROJECT_ROOT" lint-check > /dev/null 2>&1; then
echo "BLOCKED: Lint check failed." >&2
echo "Run 'make lint' to auto-fix formatting and import issues, then re-stage." >&2
exit 2
fi
echo "Lint checks passed." >&2
# Get staged Python source files (excluding tests, configs, migrations, __init__)
SOURCE_FILES=$(echo "$STAGED_FILES" | grep '\.py$' \
| grep -vE '(test_|_test\.py|conftest\.py|/tests/|__init__\.py|migrations?/|setup\.py|manage\.py)' \
|| true)
# Get staged test files
TEST_FILES=$(echo "$STAGED_FILES" | grep -E '(test_[^/]*\.py$|_test\.py$)' || true)
# If there are source changes but no test files staged, block the commit
if [ -n "$SOURCE_FILES" ] && [ -z "$TEST_FILES" ]; then
echo "BLOCKED: Python source files staged without corresponding test files." >&2
echo "" >&2
echo "Source files staged:" >&2
echo "$SOURCE_FILES" | sed 's/^/ - /' >&2
echo "" >&2
echo "Per CLAUDE.md: Every new function/class/feature MUST include tests." >&2
echo "Write tests for your changes and stage them before committing." >&2
exit 2
fi
# Determine which services are affected and run their tests
SERVICES_TO_TEST=""
# Auto-discover affected top-level directories from staged files
TOP_DIRS=$(echo "$STAGED_FILES" | sed -n 's|^\([^/]*\)/.*|\1|p' | sort -u)
for dir in $TOP_DIRS; do
# Skip non-testable directories
case "$dir" in
.github|.claude|.hydraflow|docs|ui|venv|node_modules) continue ;;
esac
if [ -d "$PROJECT_ROOT/$dir/tests" ]; then
SERVICES_TO_TEST="$SERVICES_TO_TEST $dir"
fi
done
# Also check root-level test directory
if echo "$STAGED_FILES" | grep -q "^tests/"; then
SERVICES_TO_TEST="$SERVICES_TO_TEST root"
fi
if [ -z "$SERVICES_TO_TEST" ]; then
exit 0 # No testable service changes (docs, configs, etc.)
fi
# Run tests for each affected service
FAILED_SERVICES=""
for service in $SERVICES_TO_TEST; do
if [ "$service" = "root" ]; then
TEST_DIR="$PROJECT_ROOT"
TEST_PATH="tests/"
else
TEST_DIR="$PROJECT_ROOT/$service"
TEST_PATH="tests/"
fi
if [ -d "$TEST_DIR/$TEST_PATH" ]; then
echo "Running tests for $service..." >&2
if ! (cd "$TEST_DIR" && PYTHONPATH=. VIRTUAL_ENV="$PROJECT_ROOT/venv" uv run --active pytest -m "not integration and not system_flow and not smoke" -q "$TEST_PATH" 2>&1); then
FAILED_SERVICES="$FAILED_SERVICES $service"
fi
fi
done
if [ -n "$FAILED_SERVICES" ]; then
echo "" >&2
echo "BLOCKED: Tests failed for:$FAILED_SERVICES" >&2
echo "Fix failing tests before committing." >&2
exit 2
fi
echo "All tests passed for affected services." >&2
exit 0
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 141 lines · 13 tokens per session scan C a906ab14c80d
hf.validate-tests-before-commit is a skill published in the GitHub repository T-rav/hydraflow (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 13 tokens to every session and 1,364 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
strict-tdd
Strict RED->GREEN->REFACTOR test-driven development with enforcement. Never write production code before a failing test. Atomic commits per TDD cycle.
document
Run /document pr | changelog | release-note | postmortem (or let it ask) to write the human facing prose about a change. Drafts from the real commits and diff, writing to the right place. Does not write code, tests, or specs.
feedback-resolution
Address PR review feedback through surgical fixes traceable to specific comments, apply the Boy Scout Rule only to already-modified files (separate improve: commits), recover context by code snippet rather than line number, and enforce pushback only when factually incorrect, test-breaking, or CLAUDE.md-violating. Use…
change-classification
Classify code changes as in-context, uncertain, or out-of-context using primary signals (branch diff, issue keywords, active tasks), secondary signals (directory proximity, test naming), and red-flag patterns (secrets, large binaries). Use when preparing commits or reviewing staged changes. This skill MUST be…
convention-enforcement
Validate git conventions (commit messages, branch naming, PR format, issue linkage) by detecting project-specific rules from CLAUDE.md and settings, inferring patterns from recent history. Use when creating commits, preparing PRs, or reviewing for convention compliance. This skill MUST be consulted because…
repo-config
Provides dynamic repository configuration patterns for gh-workflow agents. Use when an agent needs the default branch name for diffs, the repository owner/name for API calls, or branch naming and commit conventions for validation.