What problem does it solve? Before pushing code or publishing a pull request, it is easy to accidentally leak credentials, API keys, or unexpected personal information hidden in commit messages, Git history, PDFs, office documents, images, or archives. This Skill performs a fresh, read-only pre-publication review so sensitive content is caught before it becomes public. ## Core Features & Use Cases - Git Publication Reconstruction: Rebuilds the exact commits, blobs, tags, and LFS payloads in a push or PR range using Git object reachability, catching secrets added and later removed in history. - Document and Attachment Inspection: Applies bounded static inspection to PDFs, OOXML/ODF files, images, archives, and binaries, including metadata, OCR of rendered pages, and recursive embedded-content checks. - Context-Aware Triage and Safe Reporting: Distinguishes realistic credentials from test fixtures using multiple signals, redacts candidate values, and returns a strict verdict of clear, review_required, or block. - Use Case: Before an agent pushes a feature branch and opens a PR with a PDF attachment, run this review to verify no private key, token, or personal data is present in the commit range, PR body, or attachment bytes. ## Quick Start Use the sensitive-information-review skill to inspect my pending push and the proposed pull request text for any secrets or personal data before I publish.
