skills.rest
kotahashihama
kotahashihamaCOMMUNITY
Explore all skills by this author →
Website𝕏@kotahashihamaGitHub

audit-secrets

Scan tracked files, untracked files, and git history for leaked secrets before committing.

Updated Dec 25, 2021
Search Tags:#dotfiles#security audit#secrets#pre-commit#grep#git history#credential leak
One-click install
npx skills add https://github.com/kotahashihama/dotfiles --skill audit-secrets-kotahashihama
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-secrets
Source: https://github.com/kotahashihama/dotfiles/tree/main/.claude/skills/audit-secrets
Command: npx skills add https://github.com/kotahashihama/dotfiles --skill audit-secrets-kotahashihama

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Public repositories risk leaking API keys, tokens, and private credentials through committed files or git history. This Skill audits the public side of a dotfiles repository (home/ and scripts/) plus the full commit history to detect secret values before they are pushed to GitHub. ## Core Features & Use Cases - Ignore-rule verification: Confirms that private/ paths are properly excluded via git check-ignore before any scanning begins. - Working tree and history scanning: Searches tracked and untracked files for patterns like sk-ant, ghp_, AKIA keys, Slack tokens, and private key blocks, then scans all blobs across all branches for historical leaks. - Shell history auditing: Checks private/.zsh_history for embedded credentials and replaces values with REDACTED without shifting line numbers. - Use Case: Before pushing dotfiles updates to a public GitHub repository, run the audit to confirm no AWS keys, npm tokens, or API secrets exist in files or history, and get a report table of scanned scope and findings. ## Quick Start Ask the assistant to check whether any secrets have leaked into the public files or git history before committing and pushing.

Frequently Asked Questions about audit-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a git repository for leaked secrets before pushing?▼

Scan both tracked and untracked files with grep patterns for tokens like ghp_, AKIA, and sk-ant, then audit all historical blobs using git rev-list and git cat-file. Also verify ignore rules with git check-ignore so private directories never enter the index.

How to scan git history for committed credentials?▼

List all objects with git rev-list --objects --all, filter blobs via git cat-file --batch-check, then grep each blob's content for secret patterns. Also check added file paths with git log --diff-filter=A for sensitive names like .aws or .ssh.

Does this audit cover untracked files?▼

Yes, it scans untracked files via git status --porcelain --untracked-files=all, because untracked files are exactly what the next commit would introduce. Scanning only tracked files misses secrets about to be committed.

Why does grep skip shell history files during secret scanning?▼

grep treats files like .zsh_history as binary and suppresses matches. Add the -a flag to force text processing so credential patterns such as API_KEY=value are actually detected in history files.

What happens when a secret is found in git history?▼

The audit reports the finding to the user and stops. Rewriting history with git reset --soft and force pushing is left as an explicit user decision, never performed automatically.

Related Skills

Explore More Software Engineering Skills→
chrono-metachrono-meta
7

public-surface-audit

Scan git-tracked files for operator-private tokens and output JSON reports.

Community
Advanced
Clear-CapabilitiesClear-Capabilities
73

agentic-security:security-rotate-leak

Rotate leaked API keys and credentials end-to-end across supported providers.

Official
Advanced
mpauloskympaulosky

secret-handling

Block commits containing detected secrets and forbid reading live .env files.

Community
Advanced
balsm-healthbalsm-health
2

implementing-secrets-scanning-in-ci-cd

Automate hardcoded secret detection in CI/CD pipelines with gitleaks and trufflehog.

Official
Advanced