skills.rest
missingbulb
missingbulbCOMMUNITY
Explore all skills by this author →
GitHub

writing-repo-scanning-checks

Guides writing repo-scanning checks that select files, strip comments, and validate against real sources.

Updated Jun 12, 2026
Search Tags:#code quality#static analysis#git ls-files#repo scanning#lint check#comment stripping#forbidden tokens
One-click install
npx skills add https://github.com/missingbulb/GoogleCalendarEventCreator --skill writing-repo-scanning-checks-missingbulb
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: writing-repo-scanning-checks
Source: https://github.com/missingbulb/GoogleCalendarEventCreator/tree/main/.claudinite/shared/packs/basics/skills/writing-repo-scanning-checks
Command: npx skills add https://github.com/missingbulb/GoogleCalendarEventCreator --skill writing-repo-scanning-checks-missingbulb

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Repo-scanning checks often fail silently: they miss untracked files, match forbidden tokens inside comments, or only pass against synthetic fixtures that share the check's own blind spots. This Skill codifies the practices that make such checks trustworthy. ## Core Features & Use Cases - File set selection: Take the scan target list from git ls-files instead of a filesystem walk, and account for brand-new untracked files that a green run does not cover. - Comment-aware token matching: Strip comments with a string-aware pass (reusing stripComments from engine/checks/helpers/code-scanning.mjs) so forbidden tokens match code, not prose, in both directions. - Real-source validation: Prove a check is silent by running it against the repo's actual sources, not only a synthetic clean fixture. - Use Case: When editing a coded check under engine/checks/ or a declared check in declared-checks.json, load this Skill to avoid writing a check that passes vacuously. ## Quick Start Load this Skill before editing any repo-scanning check so the check picks its file set from git, strips comments before matching, and is proven against real sources.

Frequently Asked Questions about writing-repo-scanning-checks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a check that scans a git repository for forbidden tokens?▼

Take the file set from git ls-files rather than a filesystem walk, strip comments with a string-aware pass before matching the token, and run the check against the repo's real sources to prove it stays silent.

How do I avoid matching forbidden patterns inside code comments?▼

Strip comments before matching, using a string-aware stripper so a // inside a URL is not treated as a comment. Strip in both directions so commented-out instances and warning comments do not count as matches.

Why does my repo scan miss newly created files?▼

A brand-new file is untracked until you git add it, so git ls-files does not list it and a green run does not cover it. Stage new files before relying on the scan result.

Why is testing a lint check only against a clean fixture insufficient?▼

A synthetic fixture tends to spell the same gap the check has, so it only proves the matching logic, not the coverage. Running against the repo's real sources is the only way the check can disagree with you.

Can I reuse an existing comment-stripping helper instead of writing my own?▼

Yes, reuse stripComments from engine/checks/helpers/code-scanning.mjs. If the scan cannot import it, inline the same pass and add a comment pointing back to that source.

Related Skills

Explore More Software Engineering Skills→
missingbulbmissingbulb

writing-repo-scanning-checks

Guides writing repo-scanning checks that select files, strip comments, and validate against real sources.

Community
Intermediate
microsoftmicrosoft
190.1k

fix-ci

Diagnose and resolve failed CI checks for the current session.

Official
Basic
double-coding-labdouble-coding-lab
48

f2s-git-commit

Generates emoji-prefixed Conventional Commits and commits staged changes with knowledge-base coverage checks.

Official
Advanced
iiammaeiiammae

semgrep

Run Semgrep static analysis scans to identify security vulnerabilities and bugs.

Community
Advanced