Commit Guard
Scans Claude's git commits and pushes, and blocks ones that leak secrets.
Illustration. Actual results depend on the mod, terminal and environment.
Install
/plugin marketplace add choaticpixels/HauntedClaudeMod
/plugin install commit-guard@claude-mods
/reload-pluginsRun these commands one at a time in a Claude Code session.
claude plugin marketplace add choaticpixels/HauntedClaudeMod
claude plugin install commit-guard@claude-modsThen run /reload-plugins in your session, or start a new session.
Please install the Claude Code mod "Commit Guard" (https://github.com/choaticpixels/HauntedClaudeMod). Before installing, read the Security and Requirements sections of its README and tell me what it reads and writes, which commands it runs, whether it uses the network, and which Claude Code version, OS and terminal it needs. If everything looks fine, run claude plugin marketplace add choaticpixels/HauntedClaudeMod and claude plugin install commit-guard@claude-mods, then remind me to run /reload-plugins in my session.Send this to Claude Code so it reads the author’s instructions before installing.
git clone https://github.com/choaticpixels/HauntedClaudeMod
cd HauntedClaudeMod
claude --plugin-dir ./plugins/commit-guardClone the repository and try it in a local session with --plugin-dir.
What it accesses
Based on the author’s documentation, checked when listed; use claude plugin validate to check for yourself.
Reads
YesReads Bash commands, git diffs, untracked file contents, file sizes and .commitguardignore.
Writes files
YesStores the on/off flag and blocked-commit count in plugin storage; no project files.
Runs commands
YesRuns git status, git diff and git log to inspect staged and unpushed changes.
Network
UnspecifiedIntroduction
Commit Guard is a Claude Code function-hooks mod from the HauntedClaudeMod collection. Before Claude runs git commit or git push through Bash, it checks the change and denies the call if it finds something you would regret sharing, telling Claude what was found and how to fix it.
- Detects AWS, GitHub, Anthropic, OpenAI, Stripe, Slack and Google keys, private key blocks, JWTs, DB URLs with passwords and hardcoded api_key values.
- Flags wallet keys, seed phrases, and files like
.env*,*.pem,id_rsa,credentials.json,.npmrc,node_modules/. - Warns over 5 MB, blocks over 95 MB, and scans unpushed commits on push.
- Reports via toasts and a red band above the prompt when blocked.
Commands: /commit-guard status, scan, allow-once, on / off; quiet false positives with .commitguardignore or a commit-guard:ignore comment. The author calls it a safety net, not a guarantee: it only sees Bash-run commits and pushes, matches known patterns, and fails open with a toast. No minimum Claude Code version is stated; the site baseline is 2.1.287+. Scores are document-calibrated, not run-tested.
Who it is for
- People who let Claude commit and push but worry about leaking keys or .env files
Requirements
- No numeric Claude Code minimum stated; site baseline is 2.1.287+ function hooks.
- Only checks commits/pushes Claude runs via Bash, using known patterns.