security-auditor

Audit Git repositories for exposed secrets and sensitive data.

12|1|Updated Nov 23, 2025

Search Tags:#git #security #audit #compliance #secret-detection

Ready to run

npx skills add https://github.com/jiunbae/agent-skills --skill security-auditor-jiunbae

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/jiunbae/agent-skills/tree/main/security/security-auditor
Command: npx skills add https://github.com/jiunbae/agent-skills --skill security-auditor-jiunbae

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires git, rg, grep, bfg, git-filter-repo, and includes scripts (resource) components.

What problem does it solve?

레포지토리의 민감 정보 노출 여부를 코드와 커밋 히스토리 차원에서 점검하고, 적절한 대응을 제시합니다.

Core Features & Use Cases

Git 트래킹 파일 검사: 민감 파일이 git에 트래킹되는지 점검
민감 정보 패턴 탐지: API 키, 비밀번호 등 패턴 검사
Git 히스토리 분석: 과거 커밋에서의 누출 여부 확인
Gitignore 검증: 민감 파일 무시 규칙 점검
통합 보고서 생성: 이슈와 조치 방안 제시

Quick Start

예: "보안 점검해줘"로 전체 감사 수행

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect secrets and API keys exposed in my Git repository?▼

Secret detection scans your repository's tracked files and commit history for exposed API keys, credentials, and sensitive patterns. This Skill audits current code and Git history to identify leakage points, then provides structured findings with remediation steps.

Can I check if sensitive files are properly ignored by .gitignore?▼

Yes. Gitignore validation verifies whether sensitive files have correct ignore rules in place. The Skill analyzes your ignore configuration to ensure credentials and private data won't be tracked in future commits.

How do I audit my entire Git history for leaked secrets?▼

Git history analysis searches past commits for exposed secrets that may have been committed before ignore rules were added. The Skill identifies leakage across your full commit history and recommends removal strategies.

What's the best way to perform a security audit before releasing code?▼

A full repository audit checks tracked files, historical commits, and ignore configurations in a single pass. Run an explicit security audit to generate a comprehensive report with issues and remediation guidance before release.

Does this work with repositories using bfg or git-filter-repo for secret removal?▼

Yes. The Skill integrates with bfg and git-filter-repo as dependencies for advanced secret removal workflows. These tools help clean secrets from history after detection and audit.

What patterns of sensitive data does the audit detect?▼

The Skill detects common secret patterns including API keys, passwords, and credentials through configurable detection rules. It flags tracked files containing sensitive information and validates that ignore rules protect them.