From foundation
Standardized git hooks for security and quality enforcement across all projects.
How this skill is triggered — by the user, by Claude, or both
Slash command
/foundation:git-hooksThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Standardized git hooks for security and quality enforcement across all projects.
Standardized git hooks for security and quality enforcement across all projects.
Provides two-layer security protection:
Layer 1: Local Git Hooks (runs on developer machine)
Layer 2: GitHub Actions Workflow (runs on server)
Located in templates/ directory:
pre-commit - Secret and key scanningcommit-msg - Conventional commit format validationpre-push - Security scans (npm audit, safety check)Located in templates/:
github-security-workflow.yml - Automated security scanning pipelineThe GitHub workflow uses security scanning scripts from:
Source: plugins/quality/skills/security-patterns/scripts/
The installation script copies these to the project's scripts/ directory:
scan-secrets.sh - Comprehensive secret detectionscan-dependencies.sh - Dependency vulnerability scanningscan-owasp.sh - OWASP security pattern detectiongenerate-security-report.sh - Security report generationUse scripts/install-hooks.sh to install hooks into any git repository.
# Install all hooks
bash ~/.claude/plugins/marketplaces/dev-lifecycle-marketplace/plugins/foundation/skills/git-hooks/scripts/install-hooks.sh
# Install to specific project
bash ~/.claude/plugins/marketplaces/dev-lifecycle-marketplace/plugins/foundation/skills/git-hooks/scripts/install-hooks.sh /path/to/project
AI/ML Platform Keys:
Cloud Provider Keys:
Source Control:
Database:
Payment/Communication:
Other:
Format: type(scope): description
Valid types:
The secret scanner intelligently skips safe placeholder patterns:
✅ Allowed patterns:
AIRTABLE_API_KEY=your_airtable_key_here
OPENAI_API_KEY=your_key_here
API_KEY=placeholder
SECRET_TOKEN=example
DATABASE_URL=TODO
❌ Blocked patterns (examples of what NOT to commit):
# Example of blocked pattern - DO NOT use real keys:
AIRTABLE_API_KEY=your_airtable_key_here
OPENAI_API_KEY=your_openai_key_here
Files ending in .env.example are treated leniently if they contain placeholder indicators.
Local hooks can be bypassed when necessary (not recommended):
git commit --no-verify
git push --no-verify
GitHub Actions cannot be bypassed - they run on the server for every push/PR.
npx claudepluginhub vanman2024/dev-lifecycle-marketplace --plugin foundationRuns gitleaks scans for secret detection, validates configurations, and integrates with pre-commit hooks to prevent credential leaks in Git repos.
Guides git hook implementation, framework selection (Husky.Net, lefthook, Husky, pre-commit), and best practices for .NET/C#, JS/TS, Python repos including Conventional Commits, secret scanning, and CI/CD integration.
Detects leaked secrets, API keys, passwords, and tokens in git repositories using gitleaks. Automatically sets up pre-commit hooks to scan staged files and block commits containing secrets.