Sting25

AI Coding Rules Scaffold — AI skill for Claude Code

AI community

Two-layer enforcement (pre-commit hook + CI mirror) for small teams using AI agents.

How to install AI Coding Rules Scaffold

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Sting25/ai-coding-rules-scaffold and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What AI Coding Rules Scaffold does

Two-layer enforcement (pre-commit hook + CI mirror) for small teams using AI agents. Catches debug leaks, file growth, secrets, and forbidden patterns before they merge, and scaffold-doctor tells you when a guardrail is installed but not actually running.

Alternatives in AI

System Prompts Leaks — Extracted system prompts from ChatGPT (GPT-5.4, GPT-5.3, Codex), Claude (Opus 4.6, Sonnet 4.6, Claude Code), G 38.6k ★
Cc Mirror — Create multiple isolated Claude Code variants with custom providers (Z.ai, MiniMax, OpenRouter, LiteLLM) 2.1k ★
Prismor — Self-hosted runtime control plane for AI agents 334 ★

README

ai-coding-rules-scaffold

[![Latest release](https://img.shields.io/github/v/release/Sting25/ai-coding-rules-scaffold)](https://github.com/Sting25/ai-coding-rules-scaffold/releases/latest) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)

**Two-layer enforcement (pre-commit hook + CI mirror) for small teams using AI agents** — catches debug leaks (`print`, `console.log`, `breakpoint`, `pdb`), unbounded file growth, nested-if hell, silenced exceptions, hardcoded secrets/tokens, and stray `.env` or private-key files before they merge. The same `lib/check-*` scripts run in both layers, so the hook and CI can't drift apart and `--no-verify` doesn't become the escape hatch.

Agent-agnostic: works with Cursor, Claude Code, Copilot, Cline, Aider, or no AI at all. Python/FastAPI + TypeScript/React are first-class, with deny-pattern coverage for Vue, Svelte, PHP, Go, Rust, Java, Kotlin, Ruby, and shell — see [Supported stacks](./TECHNICAL.md#supported-stacks) in TECHNICAL.md.

What it does

Drop-in guardrails that **block bad code from being committed or merged**. One `./install.sh` wires up a local pre-commit hook _and_ a matching CI check — both running the same scripts, so nothing slips through and `--no-verify` can't quietly become the team habit.

**What it stops, out of the box:**

Debug leftovers — print(), console.log, debugger, breakpoint(), pdb/ipdb, dbg!, var_dump, and the per-language equivalents.
Secrets & key files — AWS / GCP / GitHub / GitLab / OpenAI / Anthropic / Stripe / Slack / Docker tokens, private keys, URL-embedded credentials, and stray .env / *.pem / SSH-key files.
Runaway file growth — a hard 500-line cap that forces a file to be split before it outgrows an agent's context window (the one rule never to raise).
Insecure shortcuts — curl | bash, rm -rf /, chmod 777, disabled TLS verification (verify=False, curl -k, rejectUnauthorized: false), raw `innerHTM