setup-pre-commit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-pre-commit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
检查 package-lock.json(npm)、pnpm-lock.yaml(pnpm)、yarn.lock(yarn)、bun.lockb(bun)。使用存在的那个。如果不清楚,默认使用 npm。
作为 devDependencies 安装:
husky lint-staged prettiernpx husky init这会创建 .husky/ dir,并向 package.json 添加 prepare: "husky"。
.husky/pre-commit写入这个文件(Husky v9+ 不需要 shebang):
npx lint-staged
npm run typecheck
npm run testAdapt:把 npm 替换为检测到的 package manager。如果 repo 的 package.json 中没有 typecheck 或 test script,省略对应行并告诉用户。
.lintstagedrc{
"*": "prettier --ignore-unknown --write"
}.prettierrc(如果缺失)只有在不存在 Prettier config 时才创建。使用这些 defaults:
{
"useTabs": false,
"tabWidth": 2,
"printWidth": 80,
"singleQuote": false,
"trailingComma": "es5",
"semi": true,
"arrowParens": "always"
}.husky/pre-commit 存在且可执行.lintstagedrc 存在prepare script 是 "husky"prettier config 存在npx lint-staged 验证可用Stage 所有 changed/created files,并用这个 message 提交:Add pre-commit hooks (husky + lint-staged + prettier)
这会跑过新的 pre-commit hooks,是确认一切可用的好 smoke test。
prettier --ignore-unknown 会跳过 Prettier 无法解析的 files(images 等)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.