Global Security (PR Check)
Pre-PR security & quality gates that work for any codebase with auto-fix and minimal token use.
Quick Start
# Single checks
/pr-check --checks=git # Branch name + commit format only
/pr-check --checks=linting # Linting only
/pr-check --checks=npm-audit # Dependency audit only
/pr-check --checks=security # Security patterns only
/pr-check --checks=coverage # Coverage impact only
# Combinations
/pr-check --checks=git,files,linting # Fast pre-commit combo
/pr-check --checks=linting,npm-audit,security
# Scope modes
/pr-check --pre-commit # Fast (1–3 min, cached) — default
/pr-check --full # All checks (5–15 min)
/pr-check --fix # Auto-fix + validate
/pr-check --full --report # Detailed markdown + JSON output
# Target branch/PR
/pr-check feat/my-feature --full
Available Checks
git, files, linting, security, npm-audit, pip-audit, coverage, build, performance, docs
What Each Check Validates
| Check |
Gates |
git |
Branch naming (feat/, fix/ etc), commit format (type(scope): desc), no force-push |
files |
No .env, secrets, node_modules/, dist/, OS files, large binaries |
linting |
ESLint/Pylint/Rubocop: 0 errors required |
security |
eval, exec, SQL injection, XSS, hardcoded secrets, path traversal, weak crypto |
npm-audit |
0 CRITICAL/HIGH vulnerabilities (or documented exemption) |
coverage |
New code has tests, coverage not dropped >5% |
build |
Build succeeds, no TypeScript errors, artifacts created |
Execution Modes
| Mode |
Time |
Tokens |
--checks=git |
30s |
300–500 |
--pre-commit |
1–3m |
600–1,200 |
--full |
5–15m |
2,000–4,000 |
--fix |
2–5m |
1,200–2,200 |
Blocking vs Warning Gates
Blocks PR: lint errors, test failures, CRITICAL security, npm/pip audit CRITICAL/HIGH, build failure, sensitive files, invalid commit/branch format
Warns: HIGH security patterns, coverage decrease, performance regression <20%
Auto-Fix (--fix)
Automatically fixes: ESLint errors, Prettier formatting, Stylelint, import sorting, trailing whitespace
Exemptions
// ⚠️ EXEMPTION: reason
// Issue: #1234, approved by @lead on 2026-04-08, sunset: 2026-07-08
const URL = 'https://api.example.com';
Token avg: 600–4,000 per run | Scope: Any language/stack
1---2name: global-security3description: Manage and execute tasks for global-security. Use when validating staged changes before a commit or PR — catches linting errors, secrets, vulnerable dependencies, security patterns (eval, SQL injection, XSS, hardcoded keys), bad branch names, coverage drops, and build failures. Use --checks= for targeted validation.4---5# Global Security (PR Check)67Pre-PR security & quality gates that work for any codebase with auto-fix and minimal token use.89## Quick Start1011```bash12# Single checks13/pr-check --checks=git # Branch name + commit format only14/pr-check --checks=linting # Linting only15/pr-check --checks=npm-audit # Dependency audit only16/pr-check --checks=security # Security patterns only17/pr-check --checks=coverage # Coverage impact only1819# Combinations20/pr-check --checks=git,files,linting # Fast pre-commit combo21/pr-check --checks=linting,npm-audit,security2223# Scope modes24/pr-check --pre-commit # Fast (1–3 min, cached) — default25/pr-check --full # All checks (5–15 min)26/pr-check --fix # Auto-fix + validate27/pr-check --full --report # Detailed markdown + JSON output2829# Target branch/PR30/pr-check feat/my-feature --full31```3233## Available Checks3435```36git, files, linting, security, npm-audit, pip-audit, coverage, build, performance, docs37```3839## What Each Check Validates4041| Check | Gates |42|-------|-------|43| `git` | Branch naming (`feat/`, `fix/` etc), commit format (`type(scope): desc`), no force-push |44| `files` | No `.env`, secrets, `node_modules/`, `dist/`, OS files, large binaries |45| `linting` | ESLint/Pylint/Rubocop: 0 errors required |46| `security` | eval, exec, SQL injection, XSS, hardcoded secrets, path traversal, weak crypto |47| `npm-audit` | 0 CRITICAL/HIGH vulnerabilities (or documented exemption) |48| `coverage` | New code has tests, coverage not dropped >5% |49| `build` | Build succeeds, no TypeScript errors, artifacts created |5051## Execution Modes5253| Mode | Time | Tokens |54|------|------|--------|55| `--checks=git` | 30s | 300–500 |56| `--pre-commit` | 1–3m | 600–1,200 |57| `--full` | 5–15m | 2,000–4,000 |58| `--fix` | 2–5m | 1,200–2,200 |5960## Blocking vs Warning Gates6162**Blocks PR:** lint errors, test failures, CRITICAL security, npm/pip audit CRITICAL/HIGH, build failure, sensitive files, invalid commit/branch format6364**Warns:** HIGH security patterns, coverage decrease, performance regression <20%6566## Auto-Fix (`--fix`)6768Automatically fixes: ESLint errors, Prettier formatting, Stylelint, import sorting, trailing whitespace6970## Exemptions7172```javascript73// ⚠️ EXEMPTION: reason74// Issue: #1234, approved by @lead on 2026-04-08, sunset: 2026-07-0875const URL = 'https://api.example.com';76```7778---7980**Token avg:** 600–4,000 per run | **Scope:** Any language/stack
AravindS-Wick