A .pre-commit-config.yaml with rev: stable looks pinned, but pre-commit never updates a branch rev, and every new clone gets whatever that branch holds that day. A local hook whose entry is bash -c 'curl ... | sh' runs a downloaded script on every commit, on every developer laptop. A gitleaks hook listed under ci: skip never scans the commits that skipped it locally. This skill finds those and the other git hook mistakes below, and tells you how to fix each one.

Your agent runs a scanner on .pre-commit-config.yaml (with its ci: section for pre-commit.ci) and .pre-commit-hooks.yaml, lefthook configs in YAML, JSON or TOML (lefthook-local files and remotes included) and the scripts in .lefthook/, husky hook scripts in .husky/, hook scripts in .githooks/ and similar folders, simple-git-hooks and old husky config in package.json, and the shell scripts, Makefiles and package.json scripts that install or bypass hooks. It skips comments, joins continued lines, uses pre-commit's own test for branch revs, and treats $VAR and ${{ secrets.X }} as values kept outside the file. It never runs a hook, git or any tool and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• G01: hook repositories fetched over http:// or git:// (pre-commit repo:, lefthook remote git_url)
• G02: pre-commit revs that name a branch, HEAD, a moving tag or nothing (rev: main, rev: stable, rev: '')
• G03: hooks that download code and run it (curl or wget piped into a shell or interpreter that reads the download as its program, sh -c "$(curl ...)", bash <(wget ...), iex (irm ...), or a downloaded file run with no checksum check); install hints a hook only prints are not counted
• G04: tokens, passwords and keys in hook configs and scripts (env values, --token and --password arguments, Authorization headers, a password in a repository URL, known token formats); file names, paths and setting words such as enabled are not reported

REVIEW (check before release)

• G11: pre-commit revs pinned to tags instead of commit SHAs
• G12: lefthook remotes with no ref or a branch ref
• G13: hook tools fetched without a version (additional_dependencies, docker images with no tag or :latest, npx --yes, bunx, pnpm and yarn dlx, uvx, pipx run, go run @latest)
• G14: projects with git hooks but no secret-scanning hook
• G15: secret scanners skipped in pre-commit.ci, limited to the manual stage, excluded from every file, or set to skip in lefthook
• G16: hook bypasses in scripts and hook messages (--no-verify, git commit -n, HUSKY=0, LEFTHOOK=0, SKIP= naming a secret scanner, core.hooksPath set to /dev/null)
• G17: project scripts that set core.hooksPath with --global or --system
• G18: TLS or host-key checks turned off in hooks (curl -k, http.sslVerify false, NODE_TLS_REJECT_UNAUTHORIZED=0, --trusted-host and others)
• G19: hook configs the tool never loads (husky v4 config with husky 5 or later, .pre-commit-config.yml, two lefthook configs in one folder)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example (an API with pre-commit, a web app with lefthook, a mobile app with husky), and the real report the scanner produces on the risky one

Limits

It reads each file as written. Remote hook repositories and lefthook remote configs are named but not fetched, so the code they bring is not checked. Hooks already installed in .git/hooks, core.hooksPath set in your git config, scripts that a hook calls, and CI workflows that run pre-commit are not read. G11 (tag-pinned revs) and G14 (no secret-scanning hook) fire on most configs, the pre-commit quick-start sample and default husky projects included; the agent presents them as hardening notes, not problems. G14 cannot see server-side scanning such as GitHub push protection. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 22 files: SKILL.md, the scanner in scripts/ (10 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (11 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.