safe-repo
Check the repository for sensitive data. Use when asked to "check for sensitive data" or verify no credentials or company data are committed; --diff [ ] scopes to a branch's changes. Don't use for general code review or non-git directories.
- Installs
- 49
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/helderberto/agent-skills --skill safe-repo- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads safe-repo automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Safe Repository Check
Context
Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.
Modes
- Default (full-scan): scans all git-tracked files plus history. Use for periodic audits or first-time repo review.
--diff [<base>]: scans only what changed: the branch's commits since<base>, plus staged + unstaged changes. No<base>→ staged + unstaged only. Use before a commit, fromreview, or fromto-pr --safe. Fast, no false positives from pre-existing files.
Workflow
Default (full-scan)
- Run
bash ${CLAUDE_SKILL_DIR}/scripts/scan-secrets.shto scan all tracked files for credential patterns - Check for sensitive tracked files by name:
.env*(except.env.example),*.pem,*.key,*_rsa*,*secret*,*credential* - Analyze git history for removed secrets:
git log --all --full-history -- "*.env" "*.pem" "*.key" "*secret*" "*credential*" - Review
.gitignorefor proper patterns - Report findings (see assets/report-template.md)
--diff mode
- Compute changed files:
git diff --name-only <base>...HEADwhen a base is given, plusgit diff --name-only HEAD+git diff --name-only --cached - Scan only those files with the regexes in
${CLAUDE_SKILL_DIR}/scripts/scan-secrets.sh(grep them directly) plus the filename checks above - Skip history analysis (not relevant for in-flight changes)
- Report findings scoped to changed files only
Rules
- Only check git-tracked files (
git ls-files) - ignore local configs - Check current tracked files AND git history
- Filter false positives: minified JS, node_modules, test fixtures, docs
- Verify
.gitignorecovers sensitive patterns - Report tracked files with secrets and historical commits
- Never output actual secret values in report
Error Handling
- If git history scan is slow → limit to last 100 commits with
git log --oneline -100
FAQ
What does the safe-repo skill do?
Check the repository for sensitive data. Use when asked to "check for sensitive data" or verify no credentials or company data are committed; --diff [ ] scopes to a branch's changes. Don't use for general code review or non-git directories.
How do I install safe-repo?
Run npx skills add https://github.com/helderberto/agent-skills --skill safe-repo in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/safe-repo/ (personal) or .claude/skills/safe-repo/ (project).
Which AI agents can use safe-repo?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is safe-repo safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains safe-repo?
It is published by helderberto in helderberto/agent-skills. It has 49 recorded installs.
More from helderberto/agent-skills
code-review
helderberto/agent-skills
Correctness lens for a PR or diff, used by build and review — bugs, security, performance, and code quality. Use when asked to review a PR or give pull request feedback, even when the diff is pasted inline. Don't use for local uncommitted changes, creating PRs, or merging.
explain-code
helderberto/agent-skills
Explains code with visual diagrams and analogies. Use when explaining how code works, walking through a codebase area, or when the user asks "how does this work?" Don't use for modifying code, fixing bugs, generating new implementations, or multi-session concept learning (use /teach).
commit
helderberto/agent-skills
Group unstaged changes into atomic commits by concern, matching repository style. Use when asked to "commit", "create a commit", or "commit changes". Don't use for pushing or pull requests (/to-pr).
lint
helderberto/agent-skills
Run linting and formatting checks. Use when user asks to "run linter", "/lint", "check linting", "fix lint errors", or requests code linting/formatting. Don't use for the full format/type/test pass (use /validate-code) or for installing commit-time hooks (use /setup-pre-commit).
tdd
helderberto/agent-skills
Test-driven development, from unit to end-to-end tests. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration or end-to-end tests (Playwright, Cypress). Don't use to backfill tests on existing code (/refactor) or diagnose an unknown bug (/debug).
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.