shared-tooling-git-hooks-08829c — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shared-tooling-git-hooks-08829c (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Husky v9 for git hooks with"prepare": "husky"(NOT"husky install"). lint-staged v16 for staged-only linting. commitlint for conventional commit messages. Pre-commit hooks should take < 10 seconds. SetHUSKY=0in CI/production.
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST use `"prepare": "husky"` in package.json - NOT the deprecated `"husky install"`)
(You MUST only lint staged files via lint-staged - NEVER lint the entire codebase in pre-commit)
(You MUST set `HUSKY=0` in CI/production environments to disable hooks)
(You MUST use plain hook files in `.husky/` directory - NO shebang lines or husky.sh sourcing in v9)
(You MUST keep pre-commit hooks under 10 seconds - move slow tasks to pre-push or CI)
</critical_requirements>
Auto-detection: Husky, husky init, .husky/, pre-commit hook, lint-staged, commitlint, conventional commits, commit-msg hook, git hooks, prepare script
When to use:
When NOT to use:
Key patterns covered:
Detailed Resources:
<philosophy>
Git hooks are a developer workflow tool - they catch issues early while staying fast and non-blocking. The goal is fast feedback (< 10 seconds) on staged files only. Hooks are optional infrastructure; many projects work fine without them.
When to use git hooks:
When NOT to use:
</philosophy>
<patterns>
Husky v9 uses plain shell scripts in .husky/ directory. No shebang lines needed. The prepare script auto-installs hooks for all team members.
# Full setup in 4 commands
bun add -D husky
bunx husky init # Creates .husky/ and adds "prepare": "husky" to package.json
bun add -D lint-staged
echo "bunx lint-staged" > .husky/pre-commitKey points:
"prepare": "husky" (NOT "husky install" - deprecated, will break in v10)HUSKY=0 disables hooks (CI/production); HUSKY=2 enables debug modeSee examples/core.md for full setup and package.json configuration.
lint-staged v16 runs commands only on staged files. Uses picomatch for glob matching (replaced micromatch).
// lint-staged.config.mjs
export default {
"*.{ts,tsx}": ["eslint --fix", "prettier --write"],
"*.{css,scss}": ["prettier --write"],
};Type checking requires function syntax (runs on ALL files, not just staged):
// lint-staged.config.mjs — with type checking
export default {
"*.{ts,tsx}": ["eslint --fix", "prettier --write"],
"*.{ts,tsx,js,jsx}": () => "tsc --noEmit",
};Why good: Only staged files, auto-fix reduces manual work, fast feedback
v16 breaking changes: --shell flag removed (use shell scripts instead), requires Node.js 20.18+
See examples/core.md for multiple file type patterns and v16 migration details.
commitlint v20+ validates commit messages. ESM-native - use .mjs config extension.
bun add -D @commitlint/cli @commitlint/config-conventional# .husky/commit-msg
bunx commitlint --edit $1// commitlint.config.mjs (MUST be .mjs for Node v24 compatibility)
export default {
extends: ["@commitlint/config-conventional"],
};Format: type(scope): description - types: feat, fix, docs, refactor, test, chore, etc.
See examples/core.md for v20 changes and advanced configuration.
Disable Husky where hooks should not run.
# CI pipelines
HUSKY=0 npm install
# GitHub Actions
env:
HUSKY: 0Why: Prevents hook installation failures when devDependencies not installed in production.
See examples/core.md for conditional prepare script alternatives.
For monorepos where package.json is not at the repository root.
// apps/frontend/package.json
{
"scripts": {
"prepare": "cd ../.. && husky apps/frontend/.husky"
}
}Key: Navigate to repo root, then pass the .husky/ directory path to Husky.
Step-by-step: update prepare script, remove shebangs/husky.sh sourcing from hook files, delete .husky/.gitignore, remove pinst if used.
Important: Hooks with deprecated shebang #!/usr/bin/env sh and husky.sh sourcing will fail in v10.0.0. Migrate now.
See examples/core.md for the full migration walkthrough.
</patterns>
<decision_framework>
What to run pre-commit?
├─ Fast (< 10 seconds)?
│ ├─ Lint with auto-fix → YES (lint-staged)
│ ├─ Format → YES (lint-staged)
│ └─ Type check (--noEmit) → YES (lint-staged)
└─ Slow (> 10 seconds)?
├─ Full test suite → NO (pre-push or CI)
├─ Full build → NO (CI)
└─ E2E tests → NO (CI)Which Git hook?
├─ Before committing? → pre-commit (lint-staged)
├─ Validating commit message? → commit-msg (commitlint)
├─ Before pushing? → pre-push (type check, unit tests)
├─ Before merging? → pre-merge-commit (v9.1.5+)
└─ After checkout/merge? → post-checkout / post-merge (install deps)| Task | Time | Pre-commit? |
|---|---|---|
| lint-staged (staged files only) | < 5s | Yes |
| Code formatting | < 2s | Yes |
| Type check (--noEmit) | < 10s | Yes |
| Full test suite | > 30s | No (CI) |
| E2E tests | > 60s | No (CI) |
| Full build | > 30s | No (CI) |
See reference.md for Husky vs alternatives comparison.
</decision_framework>
<red_flags>
High Priority Issues:
"prepare": "husky install" instead of "prepare": "husky" (will break in v10)"husky": { "hooks": {} } config in package.json (not supported in v9)HUSKY_GIT_PARAMS environment variable (deprecated, use $1 instead)Medium Priority Issues:
--no-verify abuse)HUSKY=0 in CI/production (hooks may fail when devDependencies not installed)#!/usr/bin/env sh and husky.sh sourcing in hook files (will fail in v10).js extension on Node v24 (use .mjs instead)Gotchas & Edge Cases:
git commit --no-verify bypasses hooks entirely - emergency escape hatch, not for regular use() => "tsc --noEmit" runs on ALL files, not just stagedpre-commit, commit-msg) - no extensions, case-sensitiveHUSKY=2 enables debug mode (replaces deprecated HUSKY_DEBUG=1).mjs config extension avoids module loading issues$1 in commit-msg hookprepare script must navigate to repo root before running husky~/.huskyrc support will be removed in v10 - migrate to .config/husky/init.shpicomatch (not micromatch) - glob patterns may differ slightly</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST use `"prepare": "husky"` in package.json - NOT the deprecated `"husky install"`)
(You MUST only lint staged files via lint-staged - NEVER lint the entire codebase in pre-commit)
(You MUST set `HUSKY=0` in CI/production environments to disable hooks)
(You MUST use plain hook files in `.husky/` directory - NO shebang lines or husky.sh sourcing in v9)
(You MUST keep pre-commit hooks under 10 seconds - move slow tasks to pre-push or CI)
Failure to follow these rules will cause slow commits, broken CI builds, and deprecated hook patterns that will fail in Husky v10.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.