Cómo usar
- Copia el comando y revisa el paquete antes de instalarlo en tu entorno de agente.
- Consulta las herramientas, credenciales y entornos necesarios en el documento original.
- Describe las entradas y el resultado deseado; contrasta la salida con las fuentes.
npx skills add https://github.com/helderberto/agent-skills --skill safe-repoAntes de empezar
- La instalación no incluye suscripción al modelo, cuota API ni permisos sobre tus archivos.
- Las estrellas e instalaciones reflejan actividad, no una prueba independiente de calidad o seguridad.
Documento original del Skill
Contenido del repositorio de origen con títulos, ejemplos, código, tablas, enlaces e imágenes preservados.
Safe Repository Check
Context
Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.
Modes
- Default (full-scan): scans all git-tracked files plus history. Use for periodic audits or first-time repo review.
- `--diff [<base>]`: scans only what changed: the branch's commits since
<base>, plus staged + unstaged changes. No<base>→ staged + unstaged only. Use before a commit, fromreview, or fromto-pr --safe. Fast, no false positives from pre-existing files.
Workflow
Default (full-scan)
- Run
bash ${CLAUDE_SKILL_DIR}/scripts/scan-secrets.shto scan all tracked files for credential patterns - Check for sensitive tracked files by name:
.env*(except.env.example),*.pem,*.key,*_rsa*,*secret*,*credential* - Analyze git history for removed secrets:
git log --all --full-history -- "*.env" "*.pem" "*.key" "*secret*" "*credential*" - Review
.gitignorefor proper patterns - Report findings (see assets/report-template.md)
--diff mode
- Compute changed files:
git diff --name-only <base>...HEADwhen a base is given, plusgit diff --name-only HEAD+git diff --name-only --cached - Scan only those files with the regexes in
${CLAUDE_SKILL_DIR}/scripts/scan-secrets.sh(grep them directly) plus the filename checks above - Skip history analysis (not relevant for in-flight changes)
- Report findings scoped to changed files only
Rules
- Only check git-tracked files (
git ls-files) - ignore local configs - Check current tracked files AND git history
- Filter false positives: minified JS, node_modules, test fixtures, docs
- Verify
.gitignorecovers sensitive patterns - Report tracked files with secrets and historical commits
- Never output actual secret values in report
Error Handling
- If git history scan is slow → limit to last 100 commits with
git log --oneline -100
