shadscan-pre-commit

Shadscan Pre-commit

Use Shadscan as an agent-owned checkpoint. This skill changes the agent's commit workflow only; it does not add repository automation.

Workflow

1. Activate before changing files:
   • Read repository instructions and git status.
   • Detect the package manager and whether node_modules/.bin/shadscan exists.
   • Never revert, stage, or rewrite unrelated changes.
2. Establish the task baseline:
   • Run the local binary with --json when present.
   • Otherwise use the matching one-shot command below.
   • Read the top-level score from JSON. Do not parse the human report.
   • Stop and explain the applicability problem when score is null.
3. Set the task floor:
   • Default to the baseline score so the task cannot introduce a regression.
   • When the user requests a higher integer floor, use the higher value.
   • Never lower the baseline unless the user explicitly accepts that regression.
   • Keep the baseline and floor in task context; do not write configuration files.
4. Complete the requested work and its normal verification.
5. Immediately before every agent-created commit:
   • Rerun the same JSON audit against the complete working tree.
   • Require a numeric score at or above the task floor.
   • When it fails, use each finding's evidence and fix guidance, repair in-scope issues, and rerun the audit.
   • When passing requires out-of-scope work, stop and report the findings. Do not commit without an explicit user override.
6. Commit only after a passing audit. Report the baseline, floor, final score, and commit alongside the normal task summary.

One-shot Commands

Use these only when no local Shadscan binary exists:

• pnpm: pnpm dlx @shadscan/cli@next --json
• npm: npx --yes @shadscan/cli@next --json
• Yarn: yarn dlx --quiet --package @shadscan/cli@next shadscan --json
• Bun: bunx @shadscan/cli@next --json

Run a detected local binary directly as node_modules/.bin/shadscan --json or with the package manager's local-exec command.

Guardrails

• Do not install dependencies or change package.json or a lockfile.
• Do not configure Git or add repository automation.
• Do not mutate staged files or run Shadscan auto-fix behavior.
• Audit the project-wide working tree, not only the staged diff.
• Do not claim this intercepts manual commits or agents that have not loaded the skill.
• Do not commit an unassessed or below-floor result unless the user explicitly overrides it in the current conversation.

Completion Format

Return a concise summary with the baseline score, enforced floor, pre-commit score, audit command, commit, and any explicit override. If no commit was requested or created, say that the final audit was advisory rather than a commit checkpoint.