prek — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited prek (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Onboard and configure prek — a fast, Rust-powered pre-commit hook manager.
prek.toml and would benefit from pre-commit hooksprek.toml.pre-commit-config.yaml to prek's native TOML formatScan the repo root for language markers:
| Marker file | Language/Framework |
|---|---|
Cargo.toml | Rust |
pyproject.toml, setup.py, requirements.txt | Python |
package.json | TypeScript/JavaScript |
go.mod | Go |
Gemfile | Ruby |
*.sh, zsh/, bin/ | Shell |
Dockerfile | Docker |
Multiple markers = polyglot project. Suggest hooks for all detected languages.
prek.toml exists, read it and identify what's already configured.pre-commit-config.yaml exists, offer to migrate (prek reads YAML natively, but TOML is the native format with more features like glob patterns)Present hooks in categories. Show what each hook does before adding. Use this reference:
#### Built-in hooks (repo = "builtin")
Fast, offline, zero-setup. Always suggest these as the foundation:
| Hook ID | What it does |
|---|---|
trailing-whitespace | Trims trailing whitespace. Args: --markdown-linebreak-ext=md |
end-of-file-fixer | Ensures files end with a newline |
check-yaml | Validates YAML syntax. Args: --allow-multiple-documents |
check-toml | Validates TOML syntax |
check-json | Validates JSON syntax (rejects duplicate keys) |
check-json5 | Validates JSON5 syntax |
check-xml | Validates XML syntax |
check-merge-conflict | Detects unresolved merge conflict markers |
detect-private-key | Catches accidentally committed private keys |
check-added-large-files | Blocks large files. Args: --maxkb=1024 |
check-case-conflict | Detects filenames that differ only by case |
check-symlinks | Validates symlinks point to existing targets |
check-executables-have-shebangs | Ensures executable scripts have shebangs |
mixed-line-ending | Detects mixed line endings (LF vs CRLF) |
fix-byte-order-marker | Removes UTF-8 BOM |
no-commit-to-branch | Blocks direct commits to protected branches |
#### Language-specific hooks (community repos)
Rust:
# Local hooks (no external repo needed)
[[repos]]
repo = "local"
[[repos.hooks]]
id = "cargo-fmt"
name = "cargo fmt"
language = "system"
entry = "cargo fmt --"
files = "\\.rs$"
pass_filenames = true
[[repos.hooks]]
id = "cargo-clippy"
name = "cargo clippy"
language = "system"
entry = "cargo clippy --all-targets --all-features -- -D warnings"
files = "\\.rs$"
pass_filenames = false
always_run = truePython:
# Ruff (linter + formatter)
[[repos]]
repo = "https://github.com/astral-sh/ruff-pre-commit"
rev = "v0.11.6"
hooks = [
{ id = "ruff", args = ["--fix"] },
{ id = "ruff-format" },
]TypeScript/JavaScript:
[[repos]]
repo = "local"
[[repos.hooks]]
id = "eslint"
name = "eslint"
language = "system"
entry = "npx eslint --fix"
files = "\\.(ts|tsx|js|jsx)$"
pass_filenames = true
[[repos.hooks]]
id = "prettier"
name = "prettier"
language = "system"
entry = "npx prettier --write"
files = "\\.(ts|tsx|js|jsx|json|css|md)$"
pass_filenames = trueGo:
[[repos]]
repo = "local"
[[repos.hooks]]
id = "go-fmt"
name = "go fmt"
language = "system"
entry = "gofmt -w"
files = "\\.go$"
pass_filenames = true
[[repos.hooks]]
id = "go-vet"
name = "go vet"
language = "system"
entry = "go vet ./..."
pass_filenames = false
always_run = trueShell:
[[repos]]
repo = "https://github.com/shellcheck-py/shellcheck-py"
rev = "a23f6b85d0fdd5bb9d564e2579e678033debbdff"
hooks = [
{ id = "shellcheck" },
]Before writing config, check the community hook repos for their current recommended versions (ruff-pre-commit, shellcheck-py, etc.) — via the Context7 MCP if your harness has it, your harness's doc-lookup tool, or the repos' GitHub releases pages. Fall back to the versions listed above if no lookup is available.
New project: Generate a complete prek.toml with:
trailing-whitespace, end-of-file-fixer, check-merge-conflict, detect-private-key, check-added-large-files)Existing project: Show a diff of what would be added. Don't duplicate hooks already present.
After writing config:
prek install
prek run --all-filesIf prek isn't installed, tell the user to install it (cargo install prek or brew install prek) and add it to their packages.yaml if one exists.
Slow checks (tests, full builds) belong on pre-push, not pre-commit:
[[repos.hooks]]
id = "pytest"
name = "Run tests"
language = "system"
entry = "pytest -x"
pass_filenames = false
always_run = true
stages = ["pre-push"]
priority = 100Exclude vendored/generated code from all hooks:
exclude = "^(vendor/|generated/|node_modules/)"Prek supports glob patterns as an alternative to regex (not compatible with upstream pre-commit):
files = { glob = "src/**/*.py" }
exclude = { glob = ["vendor/**", "dist/**"] }If .pre-commit-config.yaml exists:
prek.toml for access to prek-only features (glob patterns, repo: builtin)repo: https://github.com/pre-commit/pre-commit-hooks with repo: builtin where hooks are supported.pre-commit-config.yaml directly — only generates prek.tomlprek run --all-files can fail on first run if auto-fix hooks reformat everythingprek.toml goes stale — recommend periodic updatesprek install needs write access to .git/hooks/ — fails in worktrees with shared hooks~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.