Git Hooks Toolkit

Generate, install, and manage Git hooks with pre-built templates. Includes hooks for linting staged files, enforcing conventional commits, blocking debug sta...

Security Scan

The skill's code and runtime instructions match its stated purpose (generating and installing git hooks); nothing in the provided files indicates misdirection, but there are a few omissions and operational risks to review before use.

Purpose & Capability

The skill name/description (git hooks generation/management) aligns with the included script and templates. However the runtime requires git and python3 (the SKILL.md shows running `python3 scripts/git_hooks.py` and the templates use git commands), yet the packaged metadata declares no required binaries — this is an omission that should be corrected.

Instruction Scope

SKILL.md tells the agent to run the bundled script to list/install/show/remove hooks, which is within scope. The hook templates themselves run linters, formatters, test suites, and (in the truncated post-merge template) auto-install dependencies; these are expected for such a tool but do allow executing arbitrary project commands and package-manager install scripts when hooks trigger. Review post-merge install-deps behavior before enabling in sensitive repos.

Install Mechanism

No install spec and no network downloads; the skill is delivered as source (script + SKILL.md). That minimizes installer risk — nothing will be fetched or written by an automated installer beyond what the script does when run by the user.

Credentials

The skill declares no required environment variables or credentials and the code does not attempt to read secrets. It does rely on local developer tools (git, npx/npm, linters, test runners) which are appropriate for its purpose.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or cross-skill privileges. It only writes hooks into a repository when explicitly invoked by the user, which is expected behavior.

Assessment

This package appears to do what it says: generate and install git hooks. Before installing, manually inspect the post-merge 'install-deps' template (the file was truncated in the listing) to confirm which install commands it runs. Note that hooks will run project commands (linters, tests, package managers) on your machine — auto-installing dependencies can execute package-manager postinstall scripts, which could be risky in untrusted projects. Also ensure python3 and git are available (the metadata omits required binaries). If you plan to use it on important repositories, run it in a disposable clone first or enable only specific templates you trust.

Install production-ready Git hooks in seconds with pre-built templates.

Quick Start

# List all available templates
python3 scripts/git_hooks.py list

# Install a hook
python3 scripts/git_hooks.py install pre-commit lint-staged
python3 scripts/git_hooks.py install commit-msg conventional

# Preview before installing
python3 scripts/git_hooks.py show pre-commit no-debug

# Check what's installed
python3 scripts/git_hooks.py status

# Remove a hook
python3 scripts/git_hooks.py remove pre-commit

Available Templates

pre-commit

• lint-staged — Run ESLint/Ruff/Flake8 on staged files only
• no-debug — Block console.log, debugger, pdb, breakpoint()
• large-files — Prevent files over 500KB from being committed
• format-check — Auto-run Prettier, Black, gofmt on staged files

commit-msg

• conventional — Enforce Conventional Commits (feat/fix/docs/etc.)
• ticket-ref — Require ticket reference (#123, PROJ-456)
• no-wip — Block WIP commits on main/master/release branches

pre-push

• run-tests — Auto-detect project type and run test suite
• branch-protect — Prevent direct push to main/master

post-merge

• install-deps — Auto-install deps when lockfiles change

Commands

• list — Show all templates
• install <hook> <template> [--repo path] [--force] — Install a hook
• show <hook> <template> — Preview template content
• status [--repo path] — Show installed hooks
• remove <hook> [--repo path] — Delete a hook