Commit gate
Blocks commits that stage a secret, and helps produce clean atomic commits. The gate is TWO deterministic hooks over the shared pm-secretscan scanner: a native git pre-commit hook (covers shell commits) and a PreToolUse hook (covers commits the model makes via Bash) — because a PreToolUse hook alone misses shell commits. Use when the user says "commit-gate", "guard my commits", "block secret commits", "set up the pre-commit hook", or when splitting a large change into atomic commits / writing commit messages. Reads .claude/secrets-inventory.md.From its SKILL.md
npx -y skills add Evan-Daruwalla/claude-skill-suite --skill commit-gateAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
2.7 KB, 545 tokens by cl100k_base, as published. Nobody here has run it
commit-gate — the secret never reaches a commit
Two hooks, one scanner (../history-leak-scan/pm-secretscan.js --staged):
| Hook | File | Fires when | Effect |
|---|---|---|---|
git pre-commit | hooks/pre-commit | you commit from the shell | exit 1 → git aborts the commit |
PreToolUse (matcher Bash) | hooks/pretooluse-commit-gate.js | the model runs git commit via Bash | permissionDecision:"deny" → the tool call is blocked |
Both fail OPEN on scanner error (never wedge commits) — but NOISILY: each prints/surfaces a "gate SKIPPED (fail-open), commit is UNSCANNED" warning, because a gate that skips silently is a dead gate. Both point a real hit at secret-rotation + the secrets-inventory.
Install
- PreToolUse: add to
~/.claude/settings.jsonhooks.PreToolUse(append, don't overwrite) an entry with"matcher": "Bash"runningnode "<abs>/skills/commit-gate/hooks/pretooluse-commit-gate.js". - git pre-commit, per repo:
cp hooks/pre-commit <repo>/.git/hooks/pre-commit(already executable via sh). Or setgit config core.hooksPathglobally to a dir holding it. Install into every repo that can hold a live credential first. - The pre-commit script references the scanner by an absolute path — set the
SCANNERvariable at the top ofhooks/pre-committo wherever you cloned this suite. The PreToolUse hook resolves the scanner relative to itself.
Verify before trusting (definition of done)
node ../history-leak-scan/pm-secretscan.js --canaryprints PASS.- In a scratch repo with the pre-commit hook installed: staging a real-format secret and committing is BLOCKED; committing a placeholder-only change PASSES.
- Feed the PreToolUse hook a
git commitstdin payload whose cwd has a staged secret → it returnspermissionDecision:"deny"; a clean cwd → allow.
Atomic-commit / message layer (the judgment part)
When asked to commit a large change: propose a split into atomic commits (one logical change each), and write outcome-first messages (imperative subject, body explaining WHY). This half is model judgment; the gate above is the deterministic guarantee.
What ships with it: 2 files
3.9 KB alongside SKILL.md, 1 of them executable
hooks/
- pre-commit1.3 KB
- pretooluse-commit-gate.jsruns2.7 KB