git-hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited git-hooks (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--tool=TOOL — force a specific hook manager: husky, lefthook, pre-commit--no-commit-msg — skip commit message hook setup--no-lint-staged — run full lint instead of staged-only--ci — also generate CI workflow to mirror hook checksIf no arguments, auto-detect the best hook tool for the stack.
============================================================ PHASE 1 — STACK DETECTION ============================================================
Detect the project stack and existing tooling:
Language & Tooling:
package.json → Node/TS — prefer husky + lint-stagedpyproject.toml / requirements.txt → Python — prefer pre-commit frameworkgo.mod → Go — prefer lefthook or pre-commitCargo.toml → Rust — prefer lefthookpubspec.yaml → Flutter/Dart — prefer lefthookGemfile → Ruby — prefer lefthook or overcommitExisting Hooks (check and preserve):
.husky/ directory — existing husky setup.lefthook.yml or lefthook.yml — existing lefthook setup.pre-commit-config.yaml — existing pre-commit setup.git/hooks/ — raw git hooks (will be replaced)Lint & Format Tools (detect what to run in hooks):
.eslintrc.* / eslint.config.* / biome.json.prettierrc* / biome.jsontsconfig.json → run tsc --noEmitruff.toml / pyproject.toml [tool.ruff]pyproject.toml [tool.black]mypy.ini / pyproject.toml [tool.mypy].golangci.yml / .golangci.yamlRecord: hook tool, lint commands, format commands, type-check command, test command.
============================================================ PHASE 2 — SET UP HOOK MANAGER ============================================================
If Node.js (husky + lint-staged):
npm install --save-dev husky lint-staged npx husky init.husky/pre-commit: npx lint-stagedlint-staged config to package.json: {
"lint-staged": {
"*.{js,jsx,ts,tsx}": ["eslint --fix", "prettier --write"],
"*.{json,md,yml,yaml}": ["prettier --write"]
}
}Adjust glob patterns and commands based on detected linters. If Biome is detected instead of ESLint+Prettier:
{
"lint-staged": {
"*.{js,jsx,ts,tsx,json}": ["biome check --write"]
}
} npx lint-staged
npx tsc --noEmitIf Python (pre-commit framework):
pip install pre-commit (or add to dev dependencies).pre-commit-config.yaml: repos:
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.8.0
hooks:
- id: ruff
args: [--fix]
- id: ruff-format
- repo: https://github.com/pre-commit/mirrors-mypy
rev: v1.13.0
hooks:
- id: mypyAdjust repos based on detected tools (Black instead of Ruff, pyright instead of mypy).
pre-commit installIf Go / Rust / Flutter / Polyglot (lefthook):
npm install --save-dev lefthookbrew install lefthookgo install github.com/evilmartians/lefthook@latestlefthook.yml: pre-commit:
parallel: true
commands:
lint:
glob: "*.go"
run: golangci-lint run --fix {staged_files}
format:
glob: "*.go"
run: gofmt -w {staged_files}Adjust commands per detected language.
lefthook install============================================================ PHASE 3 — COMMIT MESSAGE HOOK ============================================================
Skip if --no-commit-msg was passed.
Set up conventional commit enforcement:
For husky (Node.js):
npm install --save-dev @commitlint/cli @commitlint/config-conventionalcommitlint.config.js: export default { extends: ['@commitlint/config-conventional'] };.husky/commit-msg: npx --no -- commitlint --edit $1For pre-commit (Python): Add to .pre-commit-config.yaml:
- repo: https://github.com/compilerla/conventional-pre-commit
rev: v3.6.0
hooks:
- id: conventional-pre-commit
stages: [commit-msg]Run: pre-commit install --hook-type commit-msg
For lefthook: Add to lefthook.yml:
commit-msg:
commands:
conventional:
run: |
MSG=$(head -1 {1})
if ! echo "$MSG" | grep -qE '^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+'; then
echo "Commit message must follow Conventional Commits format"
echo "Examples: feat: add login, fix(auth): token expiry"
exit 1
fi============================================================ PHASE 4 — VERIFY HOOKS WORK ============================================================
npx lint-stagedpre-commit run --all-fileslefthook run pre-commitfix: auto-fix lint and format violationsthen test with a valid conventional commit message.
============================================================ PHASE 5 — CI MIRROR (IF --ci) ============================================================
If --ci was passed, generate a GitHub Actions workflow that mirrors the hook checks:
Create .github/workflows/lint.yml:
name: Lint
on:
pull_request:
branches: [main, master]
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- # setup language runtime
- # run same lint/format/typecheck commands as hooksThis ensures hooks cannot be bypassed with --no-verify.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print a summary:
## Git Hooks Setup Complete
### Hook Manager: {husky|lefthook|pre-commit}
### Pre-Commit Hooks
- Lint: {eslint --fix | ruff --fix | golangci-lint run}
- Format: {prettier --write | ruff-format | gofmt}
- Type Check: {tsc --noEmit | mypy | N/A}
- Scope: {staged files only | all files}
### Commit-Msg Hook
- Enforcing: Conventional Commits (feat|fix|docs|...)
### Files Created/Modified
- {list of files created or modified}
### Existing Violations Fixed
- {N auto-fixable issues fixed, or "none"}============================================================ NEXT STEPS ============================================================
/linter if lint configuration needs improvement/release to set up automated releases that consume conventional commits--no-verify to your CI push commands if hooks run in CI separately============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /git-hooks — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
.commitlintrc without module type)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.