Como usar
- Copie o comando e verifique o pacote antes de instalar no seu ambiente de agente.
- Consulte no original as ferramentas, credenciais e ambientes necessários.
- Descreva os dados de entrada e a entrega esperada; confira a saída com as fontes.
npx skills add https://github.com/helderberto/agent-skills --skill safe-repoAntes de começar
- A instalação não inclui assinatura de modelo, franquia API ou acesso aos seus arquivos.
- Estrelas e instalações indicam atividade, não um teste independente de qualidade ou segurança.
Documento original do Skill
Renderizado do repositório de origem, preservando títulos, exemplos, código, tabelas, links e imagens.
Safe Repository Check
Context
Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.
Modes
- Default (full-scan): scans all git-tracked files plus history. Use for periodic audits or first-time repo review.
- `--diff [<base>]`: scans only what changed: the branch's commits since
<base>, plus staged + unstaged changes. No<base>→ staged + unstaged only. Use before a commit, fromreview, or fromto-pr --safe. Fast, no false positives from pre-existing files.
Workflow
Default (full-scan)
- Run
bash ${CLAUDE_SKILL_DIR}/scripts/scan-secrets.shto scan all tracked files for credential patterns - Check for sensitive tracked files by name:
.env*(except.env.example),*.pem,*.key,*_rsa*,*secret*,*credential* - Analyze git history for removed secrets:
git log --all --full-history -- "*.env" "*.pem" "*.key" "*secret*" "*credential*" - Review
.gitignorefor proper patterns - Report findings (see assets/report-template.md)
--diff mode
- Compute changed files:
git diff --name-only <base>...HEADwhen a base is given, plusgit diff --name-only HEAD+git diff --name-only --cached - Scan only those files with the regexes in
${CLAUDE_SKILL_DIR}/scripts/scan-secrets.sh(grep them directly) plus the filename checks above - Skip history analysis (not relevant for in-flight changes)
- Report findings scoped to changed files only
Rules
- Only check git-tracked files (
git ls-files) - ignore local configs - Check current tracked files AND git history
- Filter false positives: minified JS, node_modules, test fixtures, docs
- Verify
.gitignorecovers sensitive patterns - Report tracked files with secrets and historical commits
- Never output actual secret values in report
Error Handling
- If git history scan is slow → limit to last 100 commits with
git log --oneline -100
