How do I install the Skill Security Hooks skill?

Run npx skillmds@latest add iapro-community/skill-security-hooks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Skill Security Hooks safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Skill Security Hooks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Skill Security Hooks free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Skill Security Hooks?

IAPro-Community (@iapro-community) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Skill Security Hooks by iapro-community

Name: Skill Security Hooks
Author: IAPro-Community

Skill Security Hooks

Install and maintain defensive security hooks and CI gates for authorized SaaS projects. Use when asked to add pre-commit hooks, pre-push hooks, CI security scans, GitHub Actions hardening, secret scanning, dependency scanning, SAST, DAST gates, or security automation around existing repositories.

File contents

skill-security-hooks

Authorization gate

Only install hooks in a repository the user owns or has explicitly authorized. Before editing hook config, inspect existing hooks and CI so you do not replace project-specific behavior.

Record:

Repository path.
Existing core.hooksPath, .git/hooks, .githooks, pre-commit framework, Husky, Lefthook, or CI workflows.
Whether the user wants advisory local hooks or blocking gates.

Core workflow

Inspect the project stack and existing hooks before adding anything.
Preserve existing hooks. If a hook already exists, merge behavior or stop and ask before overwriting.
Keep pre-commit fast: confirmed secrets and lightweight static checks only.
Put slower dependency, container, IaC, and DAST scans in pre-push, PR CI, or scheduled CI.
Pin GitHub Actions by commit SHA when practical, not mutable tags.
Keep production DAST opt-in, scoped, and low rate.
Store scanner outputs in security-reports/ and keep secrets out of logs.
Prefer local hooks for fast feedback and CI for enforceable gates.

Default command

"{{USER_HOME}}/.orquestrador\skills\skill-security-hooks\scripts\install-security-hooks.cmd" "C:\path\to\repo" --authorized-local-repo

Hook policy

Pre-commit: run secret scan only. It should be fast and block obvious leaked credentials.
Pre-push: run local SaaS security scan when the repo has scanner tools installed.
CI pull request: run SAST, SCA, IaC, and secret scanning.
Scheduled CI: run broader dependency and DAST baseline scans against staging.
Release gate: require clean critical/high triage, not necessarily zero informational findings.

Severity and gates

Block commit: confirmed secrets in staged changes.
Block push: confirmed high/critical secrets, reachable high/critical SAST issues, or high/critical dependency findings from installed tools.
Block merge: critical/high CI findings unless documented as false positive or formally risk-accepted.
Do not block local work because optional scanner binaries are missing. Print the skipped tool and rely on CI for enforcement.

Bundled resources

Use scripts/install-security-hooks.cmd from the repository root to install local Git hooks.
Read references/github-actions-security.yml when adding CI gates.
Pair with skill-saas-security-scan for local scans and skill-saas-dast-recon for authorized URL scans.

Tool baseline

Gitleaks in pre-commit or PR CI for secrets.
Semgrep in PR CI for SAST.
Trivy or OSV-Scanner for dependency/container/IaC coverage.
ZAP baseline and conservative Nuclei templates on owned staging/preview URLs.

Failure handling

Block commits on confirmed secrets.
Block merges on critical/high findings unless the finding is documented as a false positive.
Do not print secret values. Keep redaction enabled.
Do not install package managers, global tools, or CI workflows without explicit approval.

---name: skill-security-hooksdescription: Install and maintain defensive security hooks and CI gates for authorized SaaS projects. Use when asked to add pre-commit hooks, pre-push hooks, CI security scans, GitHub Actions hardening, secret scanning, dependency scanning, SAST, DAST gates, or security automation around existing repositories.---# skill-security-hooks## Authorization gateOnly install hooks in a repository the user owns or has explicitly authorized. Before editing hook config, inspect existing hooks and CI so you do not replace project-specific behavior.Record:- Repository path.- Existing `core.hooksPath`, `.git/hooks`, `.githooks`, pre-commit framework, Husky, Lefthook, or CI workflows.- Whether the user wants advisory local hooks or blocking gates.## Core workflow1. Inspect the project stack and existing hooks before adding anything.2. Preserve existing hooks. If a hook already exists, merge behavior or stop and ask before overwriting.3. Keep pre-commit fast: confirmed secrets and lightweight static checks only.4. Put slower dependency, container, IaC, and DAST scans in pre-push, PR CI, or scheduled CI.5. Pin GitHub Actions by commit SHA when practical, not mutable tags.6. Keep production DAST opt-in, scoped, and low rate.7. Store scanner outputs in `security-reports/` and keep secrets out of logs.8. Prefer local hooks for fast feedback and CI for enforceable gates.## Default command```bat"{{USER_HOME}}/.orquestrador\skills\skill-security-hooks\scripts\install-security-hooks.cmd" "C:\path\to\repo" --authorized-local-repo```## Hook policy- Pre-commit: run secret scan only. It should be fast and block obvious leaked credentials.- Pre-push: run local SaaS security scan when the repo has scanner tools installed.- CI pull request: run SAST, SCA, IaC, and secret scanning.- Scheduled CI: run broader dependency and DAST baseline scans against staging.- Release gate: require clean critical/high triage, not necessarily zero informational findings.## Severity and gates- Block commit: confirmed secrets in staged changes.- Block push: confirmed high/critical secrets, reachable high/critical SAST issues, or high/critical dependency findings from installed tools.- Block merge: critical/high CI findings unless documented as false positive or formally risk-accepted.- Do not block local work because optional scanner binaries are missing. Print the skipped tool and rely on CI for enforcement.## Bundled resources- Use `scripts/install-security-hooks.cmd` from the repository root to install local Git hooks.- Read `references/github-actions-security.yml` when adding CI gates.- Pair with `skill-saas-security-scan` for local scans and `skill-saas-dast-recon` for authorized URL scans.## Tool baseline- Gitleaks in pre-commit or PR CI for secrets.- Semgrep in PR CI for SAST.- Trivy or OSV-Scanner for dependency/container/IaC coverage.- ZAP baseline and conservative Nuclei templates on owned staging/preview URLs.## Failure handling- Block commits on confirmed secrets.- Block merges on critical/high findings unless the finding is documented as a false positive.- Do not print secret values. Keep redaction enabled.- Do not install package managers, global tools, or CI workflows without explicit approval.

Frequently asked questions