Skip to content

Audit: LLM context linting in pre-commit and CI

What we check

The daily consistency audit is a backstop, not a feedback loop. A malformed skill, a smuggled unicode character or a secret pasted into CLAUDE.md should be caught by the commit that introduces it, not up to twenty-four hours later by a report nobody is watching at the time.

Every repository with agent context must therefore run skillsaw itself, in both places the other linters run:

  • .pre-commit-config.yaml runs the skillsaw hook, so the feedback arrives before the commit exists.
  • A CI workflow runs skillsaw, so the check cannot be skipped with --no-verify or by a clone that never ran pre-commit install.

Both are required. Pre-commit alone is advisory; CI alone is slow.

A CI job which runs pre-commit run satisfies the second half without naming skillsaw itself, because it runs every hook the pre-commit config declares. Requiring the linter to be named in a workflow as well would report a repository as non-compliant for a wiring that does run it -- and would fail this repository's own consistency-audit.yml, which installs skillsaw from PyPI and so never names the upstream repository either. The pre-commit half is still checked independently, so a workflow running pre-commit against a config with no skillsaw hook does not pass.

As with the secret scanner check, how skillsaw is invoked is deliberately not pinned. Naming the upstream repository in a pre-commit config and in a workflow is the step change; requiring a particular rev or argument list would make the audit brittle against reasonable variation.

Template

Pre-commit, alongside the existing actionlint, shellcheck and flake8 hooks:

  - repo: https://github.com/stbenjam/skillsaw
    rev: v0.18.0
    hooks:
      - id: skillsaw

The hook runs skillsaw lint, which fails on error severity only -- the same tier the llm-context-lint audit reports, so the two cannot disagree about what counts as broken.

CI, in the lane that already runs the other linters:

      - uses: stbenjam/skillsaw@v0

Pin rev and the action to a commit SHA if the repository pins its other third-party actions that way.

Repositories that enable renovate's pre-commit manager will have the rev kept current automatically.

Projects

This table is regenerated daily by the consistency audit workflow from scripts/audit-check.py results; do not edit it by hand.

Last regenerated: 2026-08-23T06:45:38.740880+00:00

Project Status Issue
actions compliant -
agent-python non-compliant agent-python#125
client-python non-compliant client-python#366
client-python-k3s non-compliant client-python-k3s#35
clingwrap non-compliant clingwrap#120
cloudgood non-compliant cloudgood#8
development compliant -
divergulent non-compliant divergulent#71
instar non-compliant instar#514
kerbside non-compliant kerbside#359
kerbside-patches non-compliant kerbside-patches#1605
library-utilities N/A -
occystrap non-compliant occystrap#119
private-ci N/A -
ryll compliant -
sfui non-compliant sfui#25
shakenfist non-compliant shakenfist#3832

Details for non-compliant projects:

  • agent-python (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • client-python (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • client-python-k3s (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • clingwrap (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • cloudgood (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • divergulent (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • instar (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • kerbside (Status): skillsaw does not run from a CI workflow
  • kerbside-patches (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • occystrap (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • sfui (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow
  • shakenfist (Status): skillsaw does not run from .pre-commit-config.yaml or a CI workflow

📝 Report an issue with this page