llm-gate skill

by rohitg00·rohitg00/pro-workflow·2.9k stars

LLM-powered quality verification using prompt hooks. Validates commit messages, code patterns, and conventions using AI before allowing operations. Use to set up intelligent guardrails.

A100/100content scan

Is the llm-gate skill safe?

Clean: nothing in its files matched our rules. We read 1 file in the folder on 2026-09-28.

No findings.

Install the llm-gate skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description.

git clone --depth 1 https://github.com/rohitg00/pro-workflow.git /tmp/pro-workflow
mkdir -p ~/.claude/skills
cp -r /tmp/pro-workflow/skills/llm-gate ~/.claude/skills/llm-gate

available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

LLM Gate

Use Claude Code's type: "prompt" hooks to create intelligent quality gates that use AI to verify operations.

Trigger

Use when:

Setting up commit message validation
Enforcing code conventions beyond what linters catch
Creating smart guardrails for specific operations

How Prompt Hooks Work

Claude Code supports hooks with type: "prompt" that run a small LLM (Haiku by default) to verify conditions:

{
  "PreToolUse": [{
    "matcher": "Bash",
    "hooks": [{
      "type": "prompt",
      "if": "Bash(git commit*)",
      "prompt": "Check if this git commit follows conventional commit format (<type>(<scope>): <summary>). The commit command is: $ARGUMENTS. Return {\"ok\": true} if valid, {\"ok\": false, \"reason\": \"...\"} if not.",
      "model": "haiku",
      "timeout": 15
    }]
  }]
}

The hook:

Substitutes $ARGUMENTS with the JSON hook input
Sends to Haiku (fast, cheap)
Expects {"ok": true} or {"ok": false, "reason": "..."}
If not ok → blocks the tool call with the reason

Example Gates

Conventional Commit Validator

{
  "type": "prompt",
  "if": "Bash(git commit*)",
  "prompt": "Verify this git commit follows conventional commits: type(scope): summary. Types: feat,fix,refactor,test,docs,chore,perf,ci. Summary under 72 chars. Input: $ARGUMENTS",
  "model": "haiku"
}

Destructive Command Guard

{
  "type": "prompt",
  "if": "Bash(rm *)",
  "prompt": "Check if this rm command is safe. Flag if it uses -rf on important directories (src/, node_modules/, .git/). Input: $ARGUMENTS",
  "model": "haiku"
}

API Key Leak Prevention

{
  "type": "prompt",
  "matcher": "Write",
  "prompt": "Check if this file write contains hardcoded API keys, secrets, passwords, or tokens. Input: $ARGUMENTS. Return ok:false if secrets found.",
  "model": "haiku"
}

Agent Hooks

For complex verification, use type: "agent" (runs a full agent):

{
  "type": "agent",
  "if": "Bash(git push*)",
  "prompt": "Review all staged changes for security issues before pushing. Check for: hardcoded secrets, SQL injection, XSS vulnerabilities, exposed internal URLs.",
  "model": "haiku",
  "timeout": 60
}

Setup Guide

Choose which operations to gate
Write the prompt (keep it focused, under 100 words)
Pick the model (haiku for speed, sonnet for accuracy)
Set timeout (15s for prompts, 60s for agents)
Add to hooks.json under the appropriate event

Rules

Use Haiku for simple checks (fast, cheap)
Use Sonnet only for complex analysis
Keep prompts under 100 words for reliability
Always include if condition to avoid running on every tool call
Set reasonable timeouts (15s prompt, 60s agent)
Test hooks before deploying to avoid blocking workflows

More skills from rohitg00/pro-workflow

Aagent-teamsCoordinate multiple Claude Code sessions as a team — lead + teammates with shared task lists, mailbox messaging, and file-lock claiming. Patterns for team sizing, task decomposition, and when to use teams vs sub-agents vs worktrees.
Aauto-setupAuto-configure quality gates, hooks, and settings for a new project. Detects project type and sets up appropriate tooling. Use when onboarding a new codebase.
Abatch-orchestrationDecompose large-scale changes into independent units and spawn parallel agents in isolated worktrees. Use for migrations, refactors, codemods, and any change touching 10+ files with the same pattern.
Cbug-captureCapture a user-reported defect as a durable GitHub issue written in the project's own domain language. Explores the codebase in parallel for context but never leaks file paths or line numbers into the issue. Use when the user reports a bug conversationally, runs a QA pass, or says "file an issue", "log this as a bug", "capture this".
Acompact-guardSmart context compaction with state preservation. Saves critical files, task progress, and working state before compaction, restores after. Use before manual compact or when auto-compact triggers.
Acontext-engineeringMaster the four operations of context engineering — Write, Select, Compress, Isolate. Manage token budgets, compaction strategies, and context partitioning to keep AI sessions sharp and efficient.
Acontext-optimizerOptimize token usage and context management. Use when sessions feel slow, context is degraded, or you're running out of budget.
Acost-trackerTrack session costs, set budget alerts, and optimize token spend. Use to check costs mid-session or set spending limits.
Adesign-engineeringApply interface craft when building or reviewing UI - motion, easing, timing, springs, component feel, and visual foundations. Use when building a component, animation, transition, hover or press state, modal, drawer, toast, or when polishing an interface so it feels right. Says "make this feel better", "add an animation", "polish the UI", "review this component".
AdeslopRemove AI-generated code slop, unnecessary comments, and over-engineering from the current branch diff. Cleans up boilerplate, simplifies abstractions, strips defensive code, and in skill-file mode lints SKILL.md files for quality. Use when cleaning up code, simplifying, removing boilerplate, before committing, or when reviewing a skill before promoting it.
Adomain-modelingBuild the project's shared language and bounded contexts before writing code, so names stay consistent and the agent stops paraphrasing domain concepts. Produces a CONTEXT.md glossary and decision records. Use at the start of a project or feature, or when the codebase and the people describing it speak different languages.
Afile-watcherConfigure file watching hooks to auto-react to config changes, env file updates, and dependency modifications. Use to set up reactive workflows.

All agent skills → · MCP servers