How do I install the Commit Gate skill?

Run npx skillmds@latest add evan-daruwalla/commit-gate in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Commit Gate safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Commit Gate?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Commit Gate free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Commit Gate?

Evan-Daruwalla (@evan-daruwalla) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Commit Gate by evan-daruwalla — Agent Skill

Name: Commit Gate
Author: Evan-Daruwalla

Commit Gate

Blocks commits that stage a secret — TWO deterministic hooks (native git pre-commit covers shell commits; PreToolUse covers commits the model makes via Bash) over the shared pm-secretscan scanner; also helps split large changes into clean atomic commits. Use when: "commit-gate", "guard my commits", "block secret commits", "set up the pre-commit hook". Reads .claude/secrets-inventory.md.

Evan-Daruwalla 575adc3 3 files · 27.4 KB Updated Sep 17, 2026

File contents

commit-gate — the secret never reaches a commit

Two hooks, one scanner (../history-leak-scan/pm-secretscan.js --staged):

Hook	File	Fires when	Effect
git `pre-commit`	`hooks/pre-commit`	you commit from the shell	exit 1 → git aborts the commit
PreToolUse (matcher `Bash\|PowerShell`)	`hooks/pretooluse-commit-gate.js`	the model runs `git commit` via Bash	`permissionDecision:"deny"` → the tool call is blocked

Both fail OPEN on scanner error (never wedge commits) — but NOISILY: each prints/surfaces a "gate SKIPPED (fail-open), commit is UNSCANNED" warning, because a gate that skips silently is a dead gate. Both point a real hit at secret-rotation + the secrets-inventory.

Install

PreToolUse: add to ~/.claude/settings.json hooks.PreToolUse (append, don't overwrite) an entry with "matcher": "Bash" running node "<abs>/skills/commit-gate/hooks/pretooluse-commit-gate.js".
git pre-commit, per repo: cp hooks/pre-commit <repo>/.git/hooks/pre-commit (already executable via sh). Or set git config core.hooksPath globally to a dir holding it. Install into every repo that can hold a live credential first.
The pre-commit script references the scanner by an absolute path — set the SCANNER variable at the top of hooks/pre-commit to wherever you cloned this suite. The PreToolUse hook resolves the scanner relative to itself.

Verify before trusting (definition of done)

node ../history-leak-scan/pm-secretscan.js --canary prints PASS.
In a scratch repo with the pre-commit hook installed: staging a real-format secret and committing is BLOCKED; committing a placeholder-only change PASSES.
Feed the PreToolUse hook a git commit stdin payload whose cwd has a staged secret → it returns permissionDecision:"deny"; a clean cwd → allow.

Atomic-commit / message layer (the judgment part)

When asked to commit a large change: propose a split into atomic commits (one logical change each), and write outcome-first messages (imperative subject, body explaining WHY). This half is model judgment; the gate above is the deterministic guarantee.

---name: commit-gatedescription: Blocks commits that stage a secret — TWO deterministic hooks (native git pre-commit covers shell commits; PreToolUse covers commits the model makes via Bash) over the shared pm-secretscan scanner; also helps split large changes into clean atomic commits. Use when: "commit-gate", "guard my commits", "block secret commits", "set up the pre-commit hook". Reads .claude/secrets-inventory.md.---# commit-gate — the secret never reaches a commitTwo hooks, one scanner (`../history-leak-scan/pm-secretscan.js --staged`):| Hook | File | Fires when | Effect ||---|---|---|---|| git `pre-commit` | `hooks/pre-commit` | you commit from the shell | exit 1 → git aborts the commit || PreToolUse (matcher `Bash\|PowerShell`) | `hooks/pretooluse-commit-gate.js` | the model runs `git commit` via Bash | `permissionDecision:"deny"` → the tool call is blocked |Both fail OPEN on scanner error (never wedge commits) — but NOISILY: eachprints/surfaces a "gate SKIPPED (fail-open), commit is UNSCANNED" warning,because a gate that skips silently is a dead gate. Both point a real hit atsecret-rotation + the secrets-inventory.## Install- **PreToolUse:** add to `~/.claude/settings.json` `hooks.PreToolUse` (append, don't overwrite) an entry with `"matcher": "Bash"` running `node "<abs>/skills/commit-gate/hooks/pretooluse-commit-gate.js"`.- **git pre-commit, per repo:** `cp hooks/pre-commit <repo>/.git/hooks/pre-commit` (already executable via sh). Or set `git config core.hooksPath` globally to a dir holding it. Install into every repo that can hold a live credential first.- The pre-commit script references the scanner by an absolute path — set the `SCANNER` variable at the top of `hooks/pre-commit` to wherever you cloned this suite. The PreToolUse hook resolves the scanner relative to itself.## Verify before trusting (definition of done)1. `node ../history-leak-scan/pm-secretscan.js --canary` prints PASS.2. In a scratch repo with the pre-commit hook installed: staging a real-format secret and committing is BLOCKED; committing a placeholder-only change PASSES.3. Feed the PreToolUse hook a `git commit` stdin payload whose cwd has a staged secret → it returns `permissionDecision:"deny"`; a clean cwd → allow.## Atomic-commit / message layer (the judgment part)When asked to commit a large change: propose a split into atomic commits (onelogical change each), and write outcome-first messages (imperative subject, bodyexplaining WHY). This half is model judgment; the gate above is the deterministicguarantee.

Frequently asked questions