16 lines
936 B
Plaintext
16 lines
936 B
Plaintext
{
|
|
"enabled": true,
|
|
"name": "Pre-Commit Security Scan",
|
|
"description": "Before any git commit shell command runs, scan staged changes for exposed secrets, API keys, hardcoded IPs/passwords, and verify .gitignore covers credentials. Flags public repo commits.",
|
|
"version": "1",
|
|
"when": {
|
|
"type": "preToolUse",
|
|
"toolTypes": [
|
|
"shell"
|
|
]
|
|
},
|
|
"then": {
|
|
"type": "askAgent",
|
|
"prompt": "A shell command is about to run. If it is a `git commit` or `git push`, perform a security review BEFORE allowing it: 1) Scan staged files for exposed secrets, API keys, tokens, hardcoded passwords, and hardcoded IP addresses. 2) Verify .gitignore includes credential files (.env, .secrets/, *.key, *.pem). 3) If the remote is a public repository, warn the user and suggest a private server. Report any findings by key name only, never echo secret values. If the command is not a git commit/push, take no action."
|
|
}
|
|
} |