What problem does it solve? Publishing a private project publicly risks leaking secrets, credentials, PII, and internal references hidden in code, config files, and git history. This Skill runs a three-phase pipeline — fork/prep, independent adversarial audit, and packaging — so a project only gets packaged after a verifier that never trusted the sanitizer's own report confirms it is clean. ## Core Features & Use Cases - Secret extraction, not deletion: Detects credentials, tokens, and connection strings, moves them into .env.example as configurable placeholders, and replaces internal domains, IPs, and personal paths using a shared pattern file. - Independent adversarial audit: Phase 2 re-derives every finding from the filesystem and git history without trusting Phase 1's report, returning PASS, FAIL, or PASS-WITH-WARNINGS, with FAIL hard-blocking packaging. - Release packaging: Generates a verified CLAUDE.md (under 100 lines), executable setup.sh, enhanced README.md, LICENSE, CONTRIBUTING.md, and GitHub issue templates. - Use Case: You have a private side project with hardcoded database URLs and your personal email in configs. Ask to open-source it, and the Skill stages a sanitized copy, audits it independently, gets your explicit decision on any warnings, then produces a ready-to-publish repository. ## Quick Start Ask the assistant to open-source the project at a given path, specifying the target directory and intended license, and let it run the three-phase release pipeline.
