pre-commitlisted

# pre-commit Invoked via `/pre-commit`. This skill acts as a pre-commit quality gate — it runs a fast subset of checks before committing and blocks the commit if critical issues are found. It can also install itself as a git hook. --- ## Mode A — Run checks now (default) When invoked without arguments, run immediately against staged files (or all modified files if nothing is staged): 1. Use Bash to get the list of files to check: ```bash git diff --cached --name-only 2>/dev/null || git diff --name-only ``` 2. **Secret scan** — Use Grep across all staged files for hardcoded secret patterns: - Assignments (`=` or `:` — covers code, YAML, and JSON): `(?i)(password|passwd|pwd|api_key|apikey|api_token|access_token|secret_key|client_secret|secret)\s*[=:]\s*['"][^'"]{8,}['"]` - Shell exports: `export\s+[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)[A-Z_]*=\S{8,}` - AWS: `(?i)(aws_access_key_id|aws_secret_access_key)\s*[=:]\s*['"][^'"]{16,}['"]` and literal `AKIA[0-9A-Z]{16}` - Modern token prefixes: `sk-ant-`, `sk-proj-`, `github_pat_`, `ghp_`, `xox[baprs]-`, `sk_live_` - Private key headers: `-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----` - High-entropy heuristic: any assignment of a 32+ char mixed-case alphanumeric literal to a variable whose name contains `key`, `token`, `secret`, or `auth` - Exclude: `*.example`, `*.sample`, `*.test.*`, `*.spec.*`, `node_modules/`, `vendor/` - **BLOCKER if found.** Report file and line number. Do not commit. When re