mcpField
S
shadscan-pre-commit

shadscan-pre-commit

github.com/theorcdevTesting & quality10848 installsUpdated today
Repository

About shadscan-pre-commit

A skill that uses Shadscan as an agent-managed quality checkpoint before agent-created commits. It compares JSON audit scores against a task-specific floor without adding repository automation.

Key features

  1. 01Check repository instructions and working-tree status
  2. 02Run local or package-manager Shadscan audits as JSON
  3. 03Set a score floor from the baseline or user request
  4. 04Rerun audits before each agent-created commit
  5. 05Block commits below the floor unless explicitly overridden

Use cases

  1. 01Prevent a code task from lowering the existing Shadscan score
  2. 02Require a requested minimum score before an agent commits
  3. 03Review audit findings and fix in-scope issues before committing

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/theorcdev/skills --skill shadscan-pre-commit

After installing, type/shadscan-pre-commitin Claude Code to confirm it loaded.

Bundled filesagents/openai.yaml

Details

From the project README

Shadscan Pre-commit

Use Shadscan as an agent-owned checkpoint. This skill changes the agent's commit workflow only; it does not add repository automation.

Workflow

  1. Activate before changing files:
    • Read repository instructions and git status.
    • Detect the package manager and whether node_modules/.bin/shadscan exists.
    • Never revert, stage, or rewrite unrelated changes.
  2. Establish the task baseline:
    • Run the local binary with --json when present.
    • Otherwise use the matching one-shot command below.
    • Read the top-level score from JSON. Do not parse the human report.
    • Stop and explain the applicability problem when score is null.
  3. Set the task floor:
    • Default to the baseline score so the task cannot introduce a regression.
    • When the user requests a higher integer floor, use the higher value.
    • Never lower the baseline unless the user explicitly accepts that regression.
    • Keep the baseline and floor in task context; do not write configuration files.
  4. Complete the requested work and its normal verification.
  5. Immediately before every agent-created commit:
    • Rerun the same JSON audit against the complete working tree.
    • Require a numeric score at or above the task floor.
    • When it fails, use each finding's evidence and fix guidance, repair in-scope issues, and rerun the audit.
    • When passing requires out-of-scope work, stop and report the findings. Do not commit without an explicit user override.
  6. Commit only after a passing audit. Report the baseline, floor, final score, and commit alongside the normal task summary.

One-shot Commands

Use these only when no local Shadscan binary exists:

  • pnpm: pnpm dlx @shadscan/cli@next --json
  • npm: npx --yes @shadscan/cli@next --json
  • Yarn: yarn dlx --quiet --package @shadscan/cli@next shadscan --json
  • Bun: bunx @shadscan/cli@next --json

Run a detected local binary directly as node_modules/.bin/shadscan --json or with the package manager's local-exec command.

Guardrails

  • Do not install dependencies or change package.json or a lockfile.
  • Do not configure Git or add repository automation.
  • Do not mutate staged files or run Shadscan auto-fix behavior.
  • Audit the project-wide working tree, not only the staged diff.
  • Do not claim this intercepts manual commits or agents that have not loaded the skill.
  • Do not commit an unassessed or below-floor result unless the user explicitly overrides it in the current conversation.

Completion Format

Return a concise summary with the baseline score, enforced floor, pre-commit score, audit command, commit, and any explicit override. If no commit was requested or created, say that the final audit was advisory rather than a commit checkpoint.

Comments

Markdown supported