skills.rest
RonanCodes
RonanCodesCOMMUNITY
Explore all skills by this author →
Website𝕏@ronancodesGitHub

security-audit

Scan git repositories for secrets, tokens, and PII using gitleaks and ripgrep.

Updated Aug 23, 2026
Search Tags:#git#security#auditing#secrets#env#pii#prepublish
One-click install
npx skills add https://github.com/RonanCodes/ronan-skills --skill security-audit-ronancodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/RonanCodes/ronan-skills/tree/main/skills/security-audit
Command: npx skills add https://github.com/RonanCodes/ronan-skills --skill security-audit-ronancodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents accidental exposure of secrets, tokens, and PII by auditing a git repository before sharing or publishing.

Core Features & Use Cases

  • Scans for API tokens, private keys, committed .env files, personal patterns, internal hostnames, and risky git history.
  • Works across working trees and git history to provide a comprehensive pre-publish safety check.
  • Provides actionable remediation guidance and recommended fixes to scrub sensitive data.

Quick Start

Run a full security audit on the current project to generate a findings report and suggested mitigations.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a git repository for secrets and PII before publishing?▼

Scanning a git repository for secrets and PII before publishing involves running pre-publish safety checks using gitleaks and ripgrep. This process audits working trees and git history, outputting a structured report with remediation steps to prevent sensitive data leaks.

What is a pre-publish safety check for preventing sensitive data leaks?▼

A pre-publish safety check for preventing sensitive data leaks is an audit that scans a git repository for API tokens, private keys, committed .env files, and personal patterns. It flags risky exposures across working trees and git history before pushing to remotes or sharing snapshots.

Does this security audit check git history or just the current working tree?▼

This security audit checks both the current working tree and the full git history. It comprehensively scans for committed secrets, tokens, internal hostnames, and personal patterns to ensure no sensitive data is exposed in previous commits before sharing or publishing.

How do I remediate committed .env files and API tokens found in git history?▼

To remediate committed .env files and API tokens found in git history, follow the actionable remediation guidance and recommended fixes provided in the structured report. This guidance helps you scrub sensitive data from your repository before pushing to remotes.

Can I use gitleaks and ripgrep to find internal hostnames and personal patterns?▼

Yes, you can use gitleaks and ripgrep to find internal hostnames and personal patterns. The security audit implements checks with these tools to flag personal patterns, internal hostnames, API tokens, and committed .env files across your repository.

Related Skills

Explore More Software Engineering Skills→
d0whc3rd0whc3r
2

speckit-git-initialize

Initialize a Git repository and create an initial commit.

Community
Intermediate
winsorllcwinsorllc

git-health

Diagnose Git repository health by analyzing commits, branches, remotes, and configuration.

Community
Intermediate
lshtramlshtram

env-security

Scan codebases for secrets and generate .env.example scaffolds with dummy values.

Community
Intermediate
harnessharness
80

configure-secret-scan

Automate secret scanning integration into existing Harness pipelines via MCP.

Official
Advanced