safe-repo

Files (4)

• SKILL.md
• report-template.md · assets/
• scan-secrets.sh · scripts/
• scan-secrets.test.sh · scripts/

SKILL.md (first lines)

# Safe Repository Check

## Context

Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.

## Modes

- **Default (full-scan)**: scans all git-tracked files plus history. Use for periodic audits or first-time repo review.
- **`--diff [<base>]`**: scans only what changed: the branch's commits since `<base>`, plus staged + unstaged changes. No `<base>` → staged + unstaged only. Use before a commit, from `review`, or from `to-pr --safe`. Fast, no false positives from pre-existing files.

## Workflow

### Default (full-scan)

1. Run this skill's `scripts/scan-secrets.sh` with `bash` to scan all tracked files for credential patterns
2. Check for sensitive tracked files by name: `.env*` (except `.env.example`), `*.pem`, `*.key`, `*_rsa*`, `*secret*`, `*credential*`
3. Analyze git history for removed secrets: `git log --all --full-history -- "*.env" "*.pem" "*.key" "*secret*" "*credential*"`
4. Review `.gitignore` for proper patterns
5. Report findings (see [assets/report-template.md](assets/report-template.md))

### `--diff` mode

1. Compute changed files: `git diff --name-only <base>...HEAD` when a base is given, plus `git diff --name-only HEAD` + `git diff --name-only --cached`
2. Scan only those files with the regexes in this skill's `scripts/scan-secrets.sh` (grep them directly) plus the filename checks above
3. Skip history analysis (not relevant for in-flight changes)
4. Report findings scoped to changed files only

## Rules

- **Only check git-tracked files** (`git ls-files`) - ignore local configs
- Check current tracked files AND git history
- Filter false positives: minified JS, node_modules, test fixtures, docs
- Verify `.gitignore` covers sensitive patterns
- Report tracked files with secrets and historical commits
- Never output actual secret values in report

## Error Handling

- If git history scan is slow → limit to last 100 commits with `git log --oneline -100`

From helderberto/agent-skills, MIT.

More from helderberto/agent-skills