vibe-pre-commit-audit

Catch the easy mistakes before they enter history.

When to Use This Skill

• Before creating a git commit
• When reviewing your own staged changes
• Before pushing to a shared branch

When NOT to Use This Skill

• Commits to personal scratch branches
• When the user explicitly says to skip checks
• Auto-generated code commits (lock files, etc.)
• Private or draft content leaking through built output (use vibe-publication-leak-guard)

Tools First, Eyeballing Second

Pattern-matching a diff by eye misses things that a deterministic scanner catches. Before the manual checks:

1. Run what the repo already has — pre-commit run, lefthook, husky, or a lint/check script. Check .pre-commit-config.yaml, package.json, and the Makefile.
2. Run a secret scanner if one is installed (gitleaks protect --staged, trufflehog git file://. --since-commit HEAD) or vibe-cli pre-commit from this repo.
3. If nothing is set up, suggest adding one (for example vibe-cli hook install, or a gitleaks pre-commit hook), then fall back to the manual checks below.

Tool findings are blocking. The manual checks cover what the tools don't.

Checks

1. Secrets & Credentials

Scan for patterns:

• API_KEY=, SECRET=, PASSWORD=, TOKEN=
• AWS keys: AKIA[0-9A-Z]{16}
• Private keys: -----BEGIN.*PRIVATE KEY-----
• Connection strings with credentials
• .env files being staged

2. Debug Statements

• console.log(, fmt.Println(, print(, debugger;
• // DEBUG, # DEBUG, /* DEBUG
• log.Debug in non-debug code paths

3. TODOs Without References

• TODO without issue number: TODO: fix this (bad)
• TODO(#123): fix this (good)
• FIXME, HACK, XXX — flag all

4. Disabled Tests

• t.Skip(, xit(, xdescribe(, @pytest.mark.skip
• Commented-out test functions
• //nolint without justification

5. Large Files

• Files > 1MB
• Binary files (images, compiled assets)
• Lock files with excessive changes

6. Commented-Out Code

• Blocks of 3+ consecutive commented-out lines of code
• Not comments explaining code, but actual code that's commented out

Output Format

Pre-Commit Audit

Status: CLEAN / WARNINGS / BLOCKED Tools run: [e.g., pre-commit run, gitleaks protect --staged, or "none configured"]

Check	Status	Findings
Scanner / hooks	✓/✗/n/a	X findings
Secrets	✓/✗	X patterns found
Debug statements	✓/✗	X occurrences
TODOs	✓/◐	X without references
Disabled tests	✓/✗	X found
Large files	✓/✗	X over limit
Commented code	✓/◐	X blocks

Blocking Issues (must fix)

1. [Secret found in file.go:42]

Warnings (should fix)

1. [TODO without reference in handler.ts:15]