| name | safe-commit |
| description | Commit changes with staged-diff secret scanning and branch protection guardrails. Use when user says "safe commit", "safe-commit", or "commit with checks". Do NOT use for regular commits — this is an opt-in extra layer on top of normal git workflow. |
Safe Commit
Adds two guardrails that existing hooks don't cover:
- Staged-diff secret scanning — catches secrets that were
git added (e.g., .env files, hardcoded tokens)
- Branch protection warning — alerts when committing directly to main/master
What This Adds (vs existing hooks)
| Check | Existing hook | safe-commit |
|---|
| Secrets in Write/Edit content | pre-edit-guard.sh | -- |
| Schema validation | agents_schema_guard.sh | -- |
| Filesystem sandboxing | check_filesystem_path.sh | -- |
Secrets in git diff --cached | -- | scan-staged.sh |
| Direct commit to main/master | -- | check-branch.sh |
Workflow
- Run
scripts/scan-staged.sh to check staged diff against shared secret patterns
- Run
scripts/check-branch.sh to verify you're not on a protected branch
- If both pass, proceed with the commit
- If either fails, report the issue and ask the user how to proceed
On-Demand Hook (demo pattern)
This skill demonstrates the on-demand hook pattern: a PreToolUse hook registered in .claude/settings.json that intercepts git commit Bash commands and runs both checks automatically before the commit proceeds.
Hook: scripts/pre-commit-hook.sh
- Registered as a
PreToolUse hook with "matcher": "Bash"
- Reads the command from stdin JSON, checks if it matches
git commit
- If not a commit command, exits silently (zero overhead for non-commit operations)
- If it is a commit: runs
scan-staged.sh (blocks on secrets) then check-branch.sh (warns on main/master)
This is the reference implementation for skill-scoped hooks. The pattern:
- Hook script reads tool input from stdin
- Filters to only relevant commands (narrow matcher)
- Composes existing scripts rather than duplicating logic
- Blocks on hard failures, warns on soft failures
Manual usage
You can also run the scripts directly:
bash agents/skills/safe-commit/scripts/scan-staged.sh
bash agents/skills/safe-commit/scripts/check-branch.sh
Gotchas
- This skill reuses
scripts/hooks/lib/secret-patterns.txt — do not duplicate patterns into a separate file
- The staged-diff scan only catches secrets in the diff output, not in unchanged parts of staged files — it complements, not replaces, the existing pre-edit hooks
- Branch protection is a warning, not a block — there are legitimate reasons to commit to main (e.g., CI fixes, sole-maintainer repos)
- If you add new secret patterns, add them to the shared
secret-patterns.txt so all hooks benefit
