security-audit

Scan git repositories for secrets, tokens, and PII using gitleaks and ripgrep.

Updated Aug 23, 2026

Search Tags:#git #security #auditing #secrets #env #pii #prepublish

Ready to run

npx skills add https://github.com/RonanCodes/ronan-skills --skill security-audit-ronancodes

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/RonanCodes/ronan-skills/tree/main/skills/security-audit
Command: npx skills add https://github.com/RonanCodes/ronan-skills --skill security-audit-ronancodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents accidental exposure of secrets, tokens, and PII by auditing a git repository before sharing or publishing.

Core Features & Use Cases

Scans for API tokens, private keys, committed .env files, personal patterns, internal hostnames, and risky git history.
Works across working trees and git history to provide a comprehensive pre-publish safety check.
Provides actionable remediation guidance and recommended fixes to scrub sensitive data.

Quick Start

Run a full security audit on the current project to generate a findings report and suggested mitigations.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a git repository for secrets and PII before publishing?▼

Scanning a git repository for secrets and PII before publishing involves running pre-publish safety checks using gitleaks and ripgrep. This process audits working trees and git history, outputting a structured report with remediation steps to prevent sensitive data leaks.

What is a pre-publish safety check for preventing sensitive data leaks?▼

A pre-publish safety check for preventing sensitive data leaks is an audit that scans a git repository for API tokens, private keys, committed .env files, and personal patterns. It flags risky exposures across working trees and git history before pushing to remotes or sharing snapshots.

Does this security audit check git history or just the current working tree?▼

This security audit checks both the current working tree and the full git history. It comprehensively scans for committed secrets, tokens, internal hostnames, and personal patterns to ensure no sensitive data is exposed in previous commits before sharing or publishing.

How do I remediate committed .env files and API tokens found in git history?▼

To remediate committed .env files and API tokens found in git history, follow the actionable remediation guidance and recommended fixes provided in the structured report. This guidance helps you scrub sensitive data from your repository before pushing to remotes.

Can I use gitleaks and ripgrep to find internal hostnames and personal patterns?▼

Yes, you can use gitleaks and ripgrep to find internal hostnames and personal patterns. The security audit implements checks with these tools to flag personal patterns, internal hostnames, API tokens, and committed .env files across your repository.