Verifying Shell changes

• Security scanning Injection, unsafe APIs and tainted data reaching a sink.
  semgrep 50% · 1 of 2 repos

  runs via pre-commit hook semgrep

  exit codes, docs, alternatives, where it runs

  • Runs inpre-commit
  • Seen inopengrep/opengrep
  • Docshttps://github.com/semgrep/semgrep
• Secret scanning Credentials and tokens committed to the repository.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Validate security contextDefine and enforce security-context behavior as a clear contract, then implement CI/runtime logic to match it without brittle assumptions...

  maximhq/bifrost Security Shell llm-infra 2026-07-14

  copy raw open
• avoid runtime credential resolutionSecurity credentials and access control mechanisms should be pre-configured at deployment or configuration time rather than resolved dyna...

  electron/electron Security Shell devtools 2025-07-23

  copy raw open
• Enforce Sensitive File PermissionsWhen creating or updating files that persist user-controlled commands/state for later execution (hooks, observer/session forwarding, etc....

  ogulcancelik/herdr Security Shell security 2026-08-03

  copy raw open
• Least-privilege secret scopingWhen granting IAM access to Secrets Manager, avoid broad resource wildcards (e.g., `arn:aws:secretsmanager:...:secret:*`). Prefer narrowi...

  awslabs/agentcore-samples Security Shell ai-agents 2026-07-23

  copy raw open
• Preserve signing entitlementsOn macOS, treat re-signing (including ad-hoc re-sign after quarantine stripping) as a security-sensitive operation: preserve the app’s en...

  nousresearch/hermes-agent Security Shell ai-agents 2026-07-16

  copy raw open

9 more in Security — the playbook lists the top 12.

• Type checking Wrong types, unhandled null or None, call signatures broken across modules.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Config-Aware Startup FailuresWhen adding startup preflight checks (permissions, filesystem writeability, required directories), treat failure as part of error-handlin...

  maximhq/bifrost Error Handling Shell llm-infra 2026-07-17

  copy raw open
• Fail Loudly, Degrade SafelyIn session/install hooks, never hide failures. Avoid OS/tool-specific command forms and exit-code-dependent fallbacks, and when an error ...

  awslabs/aidlc-workflows Error Handling Shell orchestration 2026-07-06

  copy raw open
• contextual failure handlingImplement intelligent failure handling that makes contextual decisions about retry, cleanup, and error propagation based on the type and ...

  opengrep/opengrep Error Handling Shell security 2025-07-02

  copy raw open
• Fail with messagesFunctions and scripts should never fail silently. When detecting error conditions, always provide clear error messages to stderr that inc...

  Homebrew/brew Error Handling Shell devtools 2025-01-12

  copy raw open
• Secure API URL parsingWhen parsing API endpoint URLs, implement rigorous input validation using precise regular expressions. This includes: - Escaping special ...

  Homebrew/brew API Shell devtools 2024-01-14

  copy raw open

4 more in API, Error Handling, Null Handling — the playbook lists the top 9.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• leverage standard algorithmsWhen implementing common algorithmic tasks like string parsing, sorting, or comparison operations, prefer built-in utilities and standard...

  prometheus/prometheus Algorithms Shell observability 2025-05-27

  copy raw open

• Concurrency model checking Races and orderings that fail only under specific interleavings.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Safe lock reclamationWhen implementing cross-process synchronization with filesystem primitives (e.g. `mkdir` as a mutex), avoid time-of-check-to-time-of-use ...

  cline/cline Concurrency Shell ai-agents 2026-10-07

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Verify platform compatibility firstWhen writing networking code that interacts with platform-specific features, always check for the existence of platform-specific function...

  tensorflow/tensorflow Networking Shell ml-systems 2025-03-15

  copy raw open
• Optimize git network operationsWhen performing git operations that involve network communication, use proper syntax and efficient strategies to minimize data transfer a...

  commaai/openpilot Networking Shell ml-systems 2024-11-26

  copy raw open

• End-to-end browser tests User flows broken across components, routing and the network.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Linting Bug-prone patterns, unused code and conventions the formatter does not cover.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Descriptive migration functionsName migration-related functions descriptively to convey their exact purpose and context of use. Include detailed documentation explainin...

  hashicorp/terraform Migrations Shell cloud-infra 2025-02-18

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Remove redundant AI commandsEliminate duplicate or redundant commands when setting up AI infrastructure, model serving, or ML library installations. Redundant comman...

  LMCache/LMCache AI Shell llm-infra 2025-05-19

  copy raw open
• Model precision mattersWhen deploying AI models on specialized hardware accelerators (GPUs, NPUs), ensure you're using compatible model precision formats. Diffe...

  ollama/ollama AI Shell llm-infra 2025-03-03

  copy raw open
• embedding provider configurationWhen configuring embedding providers in AI integrations, ensure proper dimension specification and use dedicated test files for different...

  Unstructured-IO/unstructured AI Shell llm-infra 2024-03-26

  copy raw open

• CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.
  pre-commit-hooks 50% · 1 of 2 repos autofix

  runs via pre-commit hook check-ast

  exit codes, docs, alternatives, where it runs

  • Commands seenpre-commit hook check-added-large-files
pre-commit hook check-ast
pre-commit hook check-case-conflict
  • Runs inpre-commit
  • Seen inopengrep/opengrep
  • Docshttps://github.com/pre-commit/pre-commit-hooks

• Externalize configuration valuesAvoid hardcoding configuration values directly in scripts, especially for values that might change between environments or contain sensit...

  chef/chef Configurations Shell cloud-infra 2025-01-06

  copy raw open
• Environment variable patternsUse consistent patterns for environment variable handling in shell scripts. Always provide sensible defaults using the `${VAR:-default}` ...

  Unstructured-IO/unstructured Configurations Shell llm-infra 2024-09-13

  copy raw open
• Avoid hard-coded configurationMake scripts and applications flexible by avoiding hard-coded configuration values. Instead, allow users to provide configuration through...

  openai/codex Configurations Shell ai-agents 2025-05-16

  copy raw open
• Safe Configuration HandlingWhen configuration affects scripts (env vars, dotenv files, compatibility gates), treat it as serialized input/output and enforce correct...

  nousresearch/hermes-agent Configurations Shell ai-agents 2026-07-27

  copy raw open
• Consistent env configFor scripts and tests, load configuration consistently and safely, and make any expensive/external prerequisite behavior opt-in. Apply th...

  awslabs/agentcore-samples Configurations Shell ai-agents 2026-07-23

  copy raw open

26 more in CI/CD, Configurations — the playbook lists the top 12.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Lockfile consistency A lockfile that no longer matches its manifest.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Write specific test assertionsMake test assertions specific and verifiable rather than relying on generic metrics or counts. Use explicit checks for expected behaviors...

  bazelbuild/bazel Testing Shell devtools 2025-07-21

  copy raw open
• Use proper testing frameworksAlways leverage established testing frameworks and APIs over custom bash scripts or direct Python execution for test automation. Using pr...

  open-telemetry/opentelemetry-python Testing Shell observability 2025-06-23

  copy raw open

• Docs build Broken cross-references, links and markup in documentation.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spelling Typos in identifiers, comments and docs.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.