Claude Skill

deterministic-checks

Use before committing, opening a PR, or reporting a task done — when you want ground-truth confirmation there are no conflict markers, live-looking credentials, debug leftovers, untracked TODOs, or oversized files, without spending a model turn re-reading every file yourself.

LLM Mart · 0 points · 5 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download rtur2003-claude-code-promts-skills-.claude_skills_deterministic-checks-37c1edc.zip · 3 KB

rtur2003/claude-code-promts-skills 52 15 forks MIT Updated 20d ago

Part of rtur2003/claude-code-promts-skills — 5 skills

Install

skills CLI npx skills add https://github.com/Rtur2003/Claude-Code-Promts-Skills/tree/main/.claude/skills/deterministic-checks

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install rtur2003-claude-code-promts-skills@llmmart

Git git clone https://github.com/Rtur2003/Claude-Code-Promts-Skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole rtur2003/claude-code-promts-skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Deterministic Checks

Overview

A shell script that scans a repository for five specific, mechanically-detectable problems and reports file:line locations. Zero model cost — it never asks Claude to "be careful" about something a regex can already prove.

Core principle: If a check can be regex or wc -c, it should never be a paragraph of instructions asking the model to look carefully. Reserve judgment calls for the model; hand mechanical checks to the script.

What it checks

Check	Catches	Misses (by design)
Conflict markers	`<<<<<<<`, `=======`, `>>>>>>>` at line start	Markers inside a fenced code block that's documenting conflict markers (a known false-positive class — see below)
Live-looking credentials	AWS keys, GitHub tokens, PEM private keys, `sk-`-style API keys	Anything not matching those four shapes — this is not a general secret scanner
Debug leftovers	`console.log`/`console.debug`, `debugger;`, `pdb.set_trace()`, `binding.pry` in JS/TS/Python/Go/Ruby files	Debug prints in languages/patterns not listed
Untracked TODO/FIXME	`TODO`/`FIXME`/`XXX` with no `#123` or `TICKET-123` reference nearby	TODOs that reference a ticket — those are considered tracked
Oversized files	Any file over 5MB, excluding lockfiles and `.min.js`	Nothing — this one has no heuristic gap

Usage

bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh [path]   # defaults to .

Exit code 0 = clean, 1 = findings printed to stdout, 2 = usage error. In a git repo it scans tracked + untracked-but-not-ignored files (via git ls-files); outside git it walks the filesystem, skipping node_modules, .git, dist, build, vendor.

Excluding a path (e.g. a docs file that intentionally shows conflict-marker syntax):

SCAN_EXCLUDE='path/to/docs-with-examples\.md' bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh .

SCAN_EXCLUDE is a grep -Ev pattern matched against each file path.

Known false-positive class

Any file that documents these patterns — a git tutorial showing <<<<<<< HEAD, a security post pasting a fake AKIA... example, this skill's own README — will trigger a match. The script cannot distinguish "this is a real conflict" from "this is prose about conflicts" with a line-oriented regex. When a finding is a documentation example, exclude that path with SCAN_EXCLUDE rather than trying to make the regex smarter — a regex that understands fenced-code-block context is not worth the fragility it adds. This is the same trade every pre-commit secret scanner makes.

When to use vs. when not to

Use before: committing, opening a PR, reporting "done" on a task that touched files, merging a branch.

Don't use for: language-specific type checking, style/formatting (use the project's linter), security review beyond the four credential shapes above (use agents/security-audit-prompt.md for judgment-requiring review), or as a substitute for tests.

Wiring it as a hook instead of running it manually

This is also usable as a Stop hook so it runs automatically instead of you remembering to invoke it — see the hooks/hooks.json pattern in agents/hooks-automation-prompt.md. A Stop hook that exits 1 blocks the turn from ending until the findings are addressed or explicitly accepted.

Remember

This script proves the absence of five specific problems. It proves nothing else. Don't report "clean" as "reviewed" — it's a floor, not a review.

Files (claude-code-promts-skills)

scripts

scan.sh 3.1 KB

#!/usr/bin/env bash
# Language-agnostic, zero-model-cost repo scan. No dependencies beyond grep/find (git optional).
# Exit code: 0 = clean, 1 = findings reported (stdout), 2 = usage error.
set -euo pipefail

ROOT="${1:-.}"
cd "$ROOT"

FOUND=0
report() { printf '%s\n' "$1"; FOUND=1; }

# Respect .gitignore when git is available; otherwise scan everything under ROOT.
# Excludes this script's own directory (its source contains the patterns it looks for)
# and any path matching *.example.* / *fixtures* / *test-data* — extend via SCAN_EXCLUDE
# (a grep -Ev pattern) for docs directories with intentional example markers.
list_files() {
  if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    git ls-files --cached --others --exclude-standard
  else
    find . -type f \
      -not -path '*/node_modules/*' -not -path '*/.git/*' \
      -not -path '*/dist/*' -not -path '*/build/*' -not -path '*/vendor/*'
  fi | grep -Ev '(^|/)\.claude/skills/deterministic-checks/scripts/'
}

FILES="$(list_files)"
if [ -n "${SCAN_EXCLUDE:-}" ]; then
  FILES="$(printf '%s\n' "$FILES" | grep -Ev "$SCAN_EXCLUDE" || true)"
fi

# 1. Unresolved merge conflict markers
CONFLICTS="$(printf '%s\n' "$FILES" | xargs -r grep -lE '^(<<<<<<<|=======|>>>>>>>)( |$)' 2>/dev/null || true)"
if [ -n "$CONFLICTS" ]; then
  report "CONFLICT MARKERS:"
  printf '%s\n' "$CONFLICTS" | sed 's/^/  /'
fi

# 2. Live-looking credentials (same patterns as hooks/scripts/block-secret-writes.sh)
SECRETS="$(printf '%s\n' "$FILES" | xargs -r grep -lE \
  'AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}|-----BEGIN[[:space:]][A-Z ]*PRIVATE KEY-----|\bsk-[A-Za-z0-9]{20,}\b' \
  2>/dev/null || true)"
if [ -n "$SECRETS" ]; then
  report "POSSIBLE CREDENTIALS:"
  printf '%s\n' "$SECRETS" | sed 's/^/  /'
fi

# 3. Debug leftovers commonly forgotten before commit
DEBUG="$(printf '%s\n' "$FILES" | grep -E '\.(js|jsx|ts|tsx|py|go|rb)$' | xargs -r grep -lnE \
  '\bconsole\.(log|debug)\(|^\s*print\((\"|'"'"')DEBUG|\bdebugger;|\bpdb\.set_trace\(\)|\bbinding\.pry\b' \
  2>/dev/null || true)"
if [ -n "$DEBUG" ]; then
  report "DEBUG LEFTOVERS:"
  printf '%s\n' "$DEBUG" | sed 's/^/  /'
fi

# 4. Untracked TODO/FIXME with no ticket reference (heuristic: no #NNN or [A-Z]+-[0-9]+ nearby)
UNTRACKED_TODOS="$(printf '%s\n' "$FILES" | xargs -r grep -nE '(TODO|FIXME|XXX)(:|\s)' 2>/dev/null \
  | grep -vE '(TODO|FIXME|XXX)[^\n]*(#[0-9]+|[A-Z]{2,}-[0-9]+)' || true)"
if [ -n "$UNTRACKED_TODOS" ]; then
  report "UNTRACKED TODO/FIXME (no ticket ref):"
  printf '%s\n' "$UNTRACKED_TODOS" | sed 's/^/  /' | head -30
fi

# 5. Large files that likely don't belong in git (>5MB, excluding common binary/lockfile allowlist)
LARGE="$(printf '%s\n' "$FILES" | while IFS= read -r f; do
  [ -f "$f" ] || continue
  case "$f" in *.lock|*package-lock.json|*.min.js) continue ;; esac
  size=$(wc -c < "$f" 2>/dev/null || echo 0)
  if [ "$size" -gt 5242880 ]; then
    printf '%s (%s bytes)\n' "$f" "$size"
  fi
done)"
if [ -n "$LARGE" ]; then
  report "LARGE FILES (>5MB):"
  printf '%s\n' "$LARGE" | sed 's/^/  /'
fi

if [ "$FOUND" -eq 0 ]; then
  echo "clean: no conflict markers, credentials, debug leftovers, untracked TODOs, or oversized files found"
  exit 0
fi

exit 1

SKILL.md 3.8 KB

---
name: deterministic-checks
description: Use before committing, opening a PR, or reporting a task done — when you want ground-truth confirmation there are no conflict markers, live-looking credentials, debug leftovers, untracked TODOs, or oversized files, without spending a model turn re-reading every file yourself.
---

# Deterministic Checks

## Overview

A shell script that scans a repository for five specific, mechanically-detectable problems and reports file:line locations. Zero model cost — it never asks Claude to "be careful" about something a regex can already prove.

**Core principle:** If a check can be regex or `wc -c`, it should never be a paragraph of instructions asking the model to look carefully. Reserve judgment calls for the model; hand mechanical checks to the script.

## What it checks

| Check | Catches | Misses (by design) |
|---|---|---|
| Conflict markers | `<<<<<<<`, `=======`, `>>>>>>>` at line start | Markers inside a fenced code block that's *documenting* conflict markers (a known false-positive class — see below) |
| Live-looking credentials | AWS keys, GitHub tokens, PEM private keys, `sk-`-style API keys | Anything not matching those four shapes — this is not a general secret scanner |
| Debug leftovers | `console.log`/`console.debug`, `debugger;`, `pdb.set_trace()`, `binding.pry` in JS/TS/Python/Go/Ruby files | Debug prints in languages/patterns not listed |
| Untracked TODO/FIXME | `TODO`/`FIXME`/`XXX` with no `#123` or `TICKET-123` reference nearby | TODOs that reference a ticket — those are considered tracked |
| Oversized files | Any file over 5MB, excluding lockfiles and `.min.js` | Nothing — this one has no heuristic gap |

## Usage

```bash
bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh [path]   # defaults to .
```

Exit code 0 = clean, 1 = findings printed to stdout, 2 = usage error. In a git repo it scans tracked + untracked-but-not-ignored files (via `git ls-files`); outside git it walks the filesystem, skipping `node_modules`, `.git`, `dist`, `build`, `vendor`.

**Excluding a path** (e.g. a docs file that intentionally shows conflict-marker syntax):

```bash
SCAN_EXCLUDE='path/to/docs-with-examples\.md' bash ${CLAUDE_SKILL_DIR}/scripts/scan.sh .
```

`SCAN_EXCLUDE` is a `grep -Ev` pattern matched against each file path.

## Known false-positive class

Any file that *documents* these patterns — a git tutorial showing `<<<<<<< HEAD`, a security post pasting a fake `AKIA...` example, this skill's own README — will trigger a match. The script cannot distinguish "this is a real conflict" from "this is prose about conflicts" with a line-oriented regex. When a finding is a documentation example, exclude that path with `SCAN_EXCLUDE` rather than trying to make the regex smarter — a regex that understands fenced-code-block context is not worth the fragility it adds. This is the same trade every pre-commit secret scanner makes.

## When to use vs. when not to

**Use before:** committing, opening a PR, reporting "done" on a task that touched files, merging a branch.

**Don't use for:** language-specific type checking, style/formatting (use the project's linter), security review beyond the four credential shapes above (use `agents/security-audit-prompt.md` for judgment-requiring review), or as a substitute for tests.

## Wiring it as a hook instead of running it manually

This is also usable as a `Stop` hook so it runs automatically instead of you remembering to invoke it — see the `hooks/hooks.json` pattern in [`agents/hooks-automation-prompt.md`](../../../prompts/english/agents/hooks-automation-prompt.md). A `Stop` hook that exits 1 blocks the turn from ending until the findings are addressed or explicitly accepted.

## Remember

> This script proves the absence of five specific problems. It proves nothing else. Don't report "clean" as "reviewed" — it's a floor, not a review.