Standardized git hooks for security and quality enforcement across all projects.
/plugin marketplace add vanman2024/dev-lifecycle-marketplace/plugin install foundation@dev-lifecycle-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
scripts/install-hooks.shscripts/merge-gitignore.shtemplates/commit-msgtemplates/github-security-workflow.ymltemplates/gitignore-comprehensive.templatetemplates/pre-committemplates/pre-pushStandardized git hooks for security and quality enforcement across all projects.
Provides two-layer security protection:
Layer 1: Local Git Hooks (runs on developer machine)
Layer 2: GitHub Actions Workflow (runs on server)
Located in templates/ directory:
pre-commit - Secret and key scanningcommit-msg - Conventional commit format validationpre-push - Security scans (npm audit, safety check)Located in templates/:
github-security-workflow.yml - Automated security scanning pipelineThe GitHub workflow uses security scanning scripts from:
Source: plugins/quality/skills/security-patterns/scripts/
The installation script copies these to the project's scripts/ directory:
scan-secrets.sh - Comprehensive secret detectionscan-dependencies.sh - Dependency vulnerability scanningscan-owasp.sh - OWASP security pattern detectiongenerate-security-report.sh - Security report generationUse scripts/install-hooks.sh to install hooks into any git repository.
# Install all hooks
bash ~/.claude/plugins/marketplaces/dev-lifecycle-marketplace/plugins/foundation/skills/git-hooks/scripts/install-hooks.sh
# Install to specific project
bash ~/.claude/plugins/marketplaces/dev-lifecycle-marketplace/plugins/foundation/skills/git-hooks/scripts/install-hooks.sh /path/to/project
AI/ML Platform Keys:
Cloud Provider Keys:
Source Control:
Database:
Payment/Communication:
Other:
Format: type(scope): description
Valid types:
The secret scanner intelligently skips safe placeholder patterns:
✅ Allowed patterns:
AIRTABLE_API_KEY=your_airtable_key_here
OPENAI_API_KEY=your_key_here
API_KEY=placeholder
SECRET_TOKEN=example
DATABASE_URL=TODO
❌ Blocked patterns (examples of what NOT to commit):
# Example of blocked pattern - DO NOT use real keys:
AIRTABLE_API_KEY=your_airtable_key_here
OPENAI_API_KEY=your_openai_key_here
Files ending in .env.example are treated leniently if they contain placeholder indicators.
Local hooks can be bypassed when necessary (not recommended):
git commit --no-verify
git push --no-verify
GitHub Actions cannot be bypassed - they run on the server for every push/PR.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.