What problem does it solve? Teams leak private identity, path, and attribution literals into tracked files when ban rules, tests, and docs quote the very secrets they forbid. This Skill provides a single entrypoint for keeping tracked content free of concrete private values while still documenting how to detect them. ## Core Features & Use Cases - Category-only policy enforcement: Tracked rules name sensitive categories and load concrete forbidden values from a git-ignored local-only registry (.verboten-literals.local) instead of hardcoding them. - OpSec vs SecOps discipline: Distinguishes behavioral rules (never print matched literals, never paste secrets into commits or PRs) from enforcement tooling (tree scans, all-ref blob scans, pre-commit hooks). - Scoped verification gates: Defines four distinct scan scopes (current tree, commit metadata, PR-unique blobs, all-ref blobs) so a clean scan is never overstated as repo-wide proof. - Use Case: Before writing a memory row or guard that touches a sensitive category, route through this Skill to load values from the local registry, use synthetic test fixtures, and route already-leaked history to the git-history-surgery specialist. ## Quick Start Ask the agent to run a security review before committing any memory row, doc, or guard that touches private identity, path, or attribution categories.
