analyze-commit

Run the analyze-commit skill on staged changes to scan for OWASP Top 10 vulnerabilities, hardcoded secrets, and injection flaws. It classifies findings by severity and blocks the commit when Critical issues like weak cryptography or exposed credentials are detected.

Use pattern matching against ORCA-style signatures such as password=, apikey=, AWS_SECRET_ACCESS_KEY, and private key blocks. The analysis scans each changed file's diff and flags matches as Critical issues that block the commit until removed.

Staged analysis uses git diff --cached to check only files added to the index, while the --all flag uses git diff to cover every uncommitted change. Choose staged for precise pre-commit checks or all for a broader working tree review.

Yes, the skill applies language-specific standards for Go, C#, TypeScript, and Dockerfiles. Go checks cover error handling and SQL injection, C# checks cover [Authorize] attributes and weak crypto, and TypeScript checks cover XSS and unhandled promises.

Commits are blocked when any test fails or when Critical severity issues are found, regardless of test presence. The quality gate also requires at least 80 percent coverage on new code, so new methods without corresponding tests will be flagged as High severity.

Regex-based pattern matching can miss obfuscated secrets, dynamic injection paths, and runtime-only vulnerabilities. If a language-specific standards file is missing, only general security checks apply, so specialized issues like Python pickle vulnerabilities may go undetected.