What problem does it solve? Accidentally pushing API keys, GitHub tokens, passwords, or phone numbers to a remote Git repository causes real credential leaks that are hard to remediate. This Skill intercepts sensitive information at the pre-push stage and provides a full cleanup protocol when leaks occur. ## Core Features & Use Cases - Pre-Push Secret Scanning: A pre-push hook scans commits for API keys, GitHub tokens, passwords, phone numbers, and a configurable KNOWN_SECRETS blacklist, blocking the push on any hit. - Leak Remediation Workflow: Guides history rewriting with git-filter-repo, credential rotation, and git ls-tree secondary verification when secrets reach historical commits. - .gitignore Audit: Detects contradictions between .gitignore comments and actual rules, and removes mistakenly tracked private files with git rm --cached. - Use Case: Before running git push on a repository containing a .env file with a GitHub token, the hook blocks the push, reports each hit, and walks you through removing the credential, adding it to the blacklist, and rotating the exposed key. ## Quick Start Ask the agent to scan this repository for leaked API keys, tokens, or phone numbers before I push to the remote.
