setup-pre-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-pre-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is an infrastructure skill, not a normal feature-delivery stage.
Use /setup-pre-commit when a project needs commit-time formatting, linting, type checking, and test hooks.
Do not use it as part of the default feature pipeline. It prepares the repo so later /execute and /pre-merge steps have stronger feedback loops.
Check for pnpm-lock.yaml (pnpm), package-lock.json (npm), yarn.lock (yarn), bun.lockb (bun). Use whichever is present. Default to npm if unclear.
Store the detected package manager — it's used for all install and run commands below.
Before installing anything, check what's already in the project:
# Check package.json for existing tools
cat package.json | grep -E "biome|prettier|eslint|oxlint|dprint" 2>/dev/null
# Check for config files
ls biome.json biome.jsonc .prettierrc .prettierrc.* prettier.config.* .eslintrc* eslint.config.* 2>/dev/nullIf an existing formatter/linter is detected: use it. Don't install a competing tool.
If nothing is detected: recommend Biome (single tool for formatting + linting, fast, zero-config defaults) and confirm with the user before installing.
Ask: "No formatter/linter detected. I'd recommend Biome — it handles both formatting and linting in one tool, is very fast, and works out of the box. Want to go with Biome, or would you prefer Prettier, ESLint, or something else?"
Install as devDependencies using the detected package manager:
Lefthook (always):
# pnpm
pnpm add -D lefthook
# npm
npm install -D lefthook
# yarn
yarn add -D lefthook
# bun
bun add -D lefthookFormatter/linter (based on detection or user choice):
| Tool | Install | Config file |
|---|---|---|
| Biome (preferred) | @biomejs/biome | biome.json |
| Prettier | prettier | .prettierrc |
| ESLint | eslint | eslint.config.* |
| Prettier + ESLint | prettier eslint | both |
| oxlint | oxlint | oxlint.json |
| dprint | dprint | dprint.json |
npx lefthook installThis creates the git hook symlinks. No .husky/ directory, no prepare script needed — Lefthook manages hooks directly via lefthook.yml.
Add a prepare script to package.json so hooks are installed automatically for anyone who clones the repo:
{
"scripts": {
"prepare": "lefthook install"
}
}lefthook.ymlCreate lefthook.yml at the repo root. The configuration depends on which formatter/linter was detected or chosen.
With Biome (preferred):
pre-commit:
parallel: true
commands:
format-and-lint:
glob: "*.{js,ts,jsx,tsx,json,css}"
run: npx @biomejs/biome check --write --staged {staged_files}
stage_fixed: true
typecheck:
run: {package_manager} run typecheck
test:
run: {package_manager} run testWith Prettier:
pre-commit:
parallel: true
commands:
format:
glob: "*.{js,ts,jsx,tsx,json,css,md,yml,yaml}"
run: npx prettier --write {staged_files}
stage_fixed: true
typecheck:
run: {package_manager} run typecheck
test:
run: {package_manager} run testWith ESLint:
pre-commit:
parallel: true
commands:
lint:
glob: "*.{js,ts,jsx,tsx}"
run: npx eslint --fix {staged_files}
stage_fixed: true
typecheck:
run: {package_manager} run typecheck
test:
run: {package_manager} run testWith Prettier + ESLint:
pre-commit:
parallel: true
commands:
format:
glob: "*.{js,ts,jsx,tsx,json,css,md,yml,yaml}"
run: npx prettier --write {staged_files}
stage_fixed: true
lint:
glob: "*.{js,ts,jsx,tsx}"
run: npx eslint --fix {staged_files}
stage_fixed: true
typecheck:
run: {package_manager} run typecheck
test:
run: {package_manager} run testAdapt the config:
{package_manager} with the detected package manager (pnpm, npm, yarn, bun)typecheck script in package.json, omit that command and tell the usertest script in package.json, omit that command and tell the userglob patterns to match the project's file typesOnly create if no config exists and the user chose to install a new tool.
Biome (`biome.json`):
{
"$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
"organizeImports": {
"enabled": true
},
"formatter": {
"indentStyle": "space",
"indentWidth": 2,
"lineWidth": 80
},
"linter": {
"enabled": true,
"rules": {
"recommended": true
}
}
}Prettier (`.prettierrc`):
{
"useTabs": false,
"tabWidth": 2,
"printWidth": 80,
"singleQuote": false,
"trailingComma": "es5",
"semi": true,
"arrowParens": "always"
}lefthook.yml exists at repo rootprepare script in package.json is "lefthook install"npx lefthook run pre-commit to verify hooks work.husky/ directory exists (if migrating from Husky, remove it)If the project previously used Husky:
# Remove Husky artifacts
rm -rf .husky
# Remove Husky from dependencies
{package_manager} remove husky lint-staged
# Remove .lintstagedrc if it exists and is no longer needed
rm -f .lintstagedrc .lintstagedrc.* lint-staged.config.*Update the prepare script in package.json from "husky" to "lefthook install".
Stage all changed/created files and commit with message:
chore: add pre-commit hooks (lefthook + biome) (or substitute the actual formatter name)
This will run through the new pre-commit hooks — a good smoke test that everything works.
npx lint-staged wrapperlefthook.yml is declarative and version-controlled; Husky uses shell scripts in .husky/biome.json instead of .prettierrc + .eslintrc + conflicting rules/execute and /pre-merge by making basic verification more automatic~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.