public-surface-audit

What problem does it solve?

When splitting a repository into public methodology content and private operator-specific content, it is common to accidentally commit private tokens like real usernames, absolute home paths, or company asset names to git-tracked public files. This skill eliminates that risk by scanning all tracked files for these leaks before publication, ensuring your public repository stays clean, model-agnostic, and free of confidential operator data.

Core Features & Use Cases

• Tracked-file-only scanning: Deliberately excludes gitignored private files like CLAUDE.local.md to avoid false positives, focusing exclusively on the public surface that will be shared or published.
• Severity-classified leak detection: Flags high-severity leaks (real usernames, company assets), medium-severity issues (absolute home paths that leak user identity and local filesystem layout), and low-severity drift (private companion store or wiring names) with clear file:line reporting.
• Dual output modes: Provides human-readable formatted reports for interactive use and machine-parseable JSON output for automated CI/CD pre-push or pre-publish hook gating.
• Proactive gitignore safeguard: Catches files that should be private but are not actually ignored by git, preventing future accidental commits of sensitive data. Use case: Before pushing a new version of your open-source project to a public GitHub repository, run this scan to confirm no personal or company-private data is exposed in your tracked files.

Quick Start

Use the public-surface-audit skill to scan your current git repository for any operator-private tokens that have been accidentally committed to tracked files.