helderberto/safe-repo
safe-repo/SKILL.md
Check for sensitive data in repository. Use when user asks to "check for sensitive data", "/safe-repo", or wants to verify no company/credential data is in the repository. Don't use for general code review, adding .gitignore entries, or scanning non-git directories.
$ install --global
skillsauthnpx skillsauth add helderberto/skills safe-repoInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 30, 2026, 2:40 AM5.9s4 files scanned
SKILL.md
- name:
- safe-repo
- description:
- Check for sensitive data in repository. Use when user asks to "check for sensitive data", "/safe-repo", or wants to verify no company/credential data is in the repository. Don't use for general code review, adding .gitignore entries, or scanning non-git directories.
Safe Repository Check
Context
Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.
Workflow
- Run
bash scripts/scan-secrets.shto scan all tracked files for credential patterns (see references/patterns.md for full pattern list) - Check for sensitive tracked files (.env, secrets)
- Analyze git history for removed secrets
- Review
.gitignorefor proper patterns - Report findings (see assets/report-template.md)
Rules
- Only check git-tracked files (
git ls-files) - ignore local configs - Check current tracked files AND git history
- Filter false positives: minified JS, node_modules, test fixtures, docs
- Verify
.gitignorecovers sensitive patterns - Report tracked files with secrets and historical commits
- Never output actual secret values in report
Error Handling
- If
git ls-filesreturns nothing → verify the current directory is a git repository; rungit statusto confirm - If git history scan is slow → limit to last 100 commits with
git log --oneline -100 - If false positives are high → cross-reference against patterns in references/patterns.md before reporting
Related Skills
helderberto/caveman
testing
VerifiedTrustedCommunity
Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
10SKILL.mdUpdated May 12, 2026
helderberto/handoff
documentation
VerifiedTrustedCommunity
Compact the current conversation into a handoff doc so a fresh agent can continue the work. Use when user asks to "handoff", "/handoff", "hand this off", or wants to end a session mid-task. Don't use for summarising completed work, writing PRDs/plans/ADRs, or committing changes.
8SKILL.mdUpdated May 20, 2026
helderberto/create-skill
development
VerifiedTrustedCommunity
Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill, or asks "make a skill for X".
8SKILL.mdUpdated May 20, 2026
helderberto/zoom-out
development
VerifiedTrustedCommunity
Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
8SKILL.mdUpdated May 12, 2026