What problem does it solve? Code written by an AI agent is often committed without independent verification, letting security flaws, logic errors, and test regressions slip through. This Skill enforces a pre-commit verification pipeline so no agent verifies its own work. ## Core Features & Use Cases - Static Security Scan: Greps added diff lines for hardcoded secrets, shell injection, eval/exec, unsafe pickle deserialization, and SQL injection patterns. - Baseline-Aware Quality Gates: Runs pytest, npm test, cargo test, or go test plus linters (ruff, mypy, eslint, clippy, go vet) and only blocks on NEW failures versus the pre-change baseline. - Independent Reviewer Subagent: Delegates the diff to a fresh-context reviewer that returns a fail-closed JSON verdict on security concerns and logic errors. - Auto-Fix Loop: Spawns a separate fix agent for up to 2 fix-and-reverify cycles before escalating to the user, then commits with a [verified] prefix. - Use Case: After implementing a feature touching multiple files, run this pipeline before git commit to catch a leaked API key and a broken test that self-review would have missed. ## Quick Start Verify my staged changes with the pre-commit review pipeline and fix any issues before committing.
