| name | lint-format-security |
| description | Run linters and security scanners with bounded scope — ruff, prettier, eslint, shellcheck, trivy, hadolint. |
Lint, format, and security
Purpose
Static analysis and container/config scanning without silent auto-fix at scale.
When to Use
- Python:
ruff, pyright
- JS/TS:
eslint, prettier
- Shell:
shellcheck
- Containers/IaC:
hadolint, trivy
Required Tools
Project-defined; common: ruff, eslint, prettier, shellcheck, trivy.
Install
Install blocks are shared — See install-blocks.md.
Windows PowerShell
Use winget blocks from the reference when provisioning a new machine.
WSL2 Ubuntu
Use apt/curl blocks from the reference; symlink fdfind → fd if needed.
macOS
Use Homebrew blocks from the reference.
Common Commands
ruff check path/to/module --output-format=concise
ruff format --check path/to/module
eslint src/ --max-warnings 0
prettier --check 'src/**/*.{ts,tsx,json}'
shellcheck scripts/*.sh
trivy fs --scanners vuln --exit-code 0 .
Agent-Safe Patterns
Commands Requiring Confirmation
--fix, --write, --auto-fix on broad trees. See commands-requiring-confirmation.md.
Troubleshooting
- Missing plugins: use project devDependencies / uv tools.
- trivy DB download: may need network once.
Windows Notes
WSL2 Notes
Verification Checklist