shipshitdev/git-safety
bundles/security/skills/git-safety/SKILL.md
Scans, cleans, and prevents secrets in git history across four modes: scan (detect sensitive files in the current state and history), clean (rewrite history to remove secrets using git-filter-repo or BFG), prevent (add .gitignore and pre-commit hooks), and full (all three in sequence). Use when the user asks to check for leaked credentials, scrub a secret from git history, force-push a cleaned repo, set up pre-commit secret prevention, or run a full git security audit.
$ install --global
skillsauthnpx skillsauth add shipshitdev/library git-safetyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 1, 2026, 5:12 AM112.9s3 files scanned
SKILL.md
- name:
- git-safety
- description:
- >-
- Scans, cleans, and prevents secrets in git history across four modes:
- scan
- version:
- 1.0.0
- tags:
- git, security, secrets
- disable-model-invocation:
- true
Git Safety Skill
Contract
Inputs:
- Repository root
- Mode: scan, prevent, clean, or full
- Optional leaked path, secret pattern, or affected ref range
Outputs:
- Sensitive file/history findings
- Rotation and remediation checklist
- Commands required for prevention or history cleanup
Creates/Modifies:
- Scan mode: no file changes
- Prevent mode:
.gitignoreand optional hook updates - Clean mode: rewritten git history only after explicit confirmation
External Side Effects:
- May force-push rewritten history in clean mode
- May require credential rotation outside the repository
Confirmation Required:
- Before history rewriting
- Before force-pushing
- Before changing hooks or ignore rules in shared repos
Delegates To:
security-auditfor broader application-security reviewopen-source-checkerbefore publishing a private repo
CRITICAL WARNING
Removing secrets from git history does NOT make them safe!
Even after cleaning git history:
- GitHub is scraped by bots within seconds of a push
- Archive services may have captured snapshots
- Forks retain the original history
- CI/CD logs may contain the values
ALWAYS rotate leaked credentials immediately. Cleaning history is NOT enough.
Modes of Operation
1. /git-safety scan - Detect Sensitive Files
Scan repository for sensitive files in current state and git history.
2. /git-safety clean - Remove from History
Remove sensitive files using git-filter-repo or BFG.
3. /git-safety prevent - Set Up Prevention
Configure .gitignore and pre-commit hooks.
4. /git-safety full - Complete Audit
Run all three operations in sequence.
Sensitive File Patterns
.env, .env.*, credentials.json, service-account*.json
*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret
Quick Commands
Scan for sensitive files in history:
git log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'
Remove .env from all history:
git filter-repo --path .env --invert-paths --force
git push origin --force --all
Add to .gitignore:
echo -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore
Emergency Response
If you've leaked credentials:
- IMMEDIATELY rotate the credential
- Check access logs
- Run
/git-safety clean - Force push cleaned history
- Notify team to re-clone
- Update .gitignore
- Set up pre-commit hooks
For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see: references/full-guide.md
Related Skills
shipshitdev/typescript-refactor
development
VerifiedTrustedCommunity
TypeScript refactoring and modernization guidelines from a principal specialist perspective. This skill should be used when refactoring, reviewing, or modernizing TypeScript code to ensure type safety, compiler performance, and idiomatic patterns. Triggers on tasks involving TypeScript type architecture, narrowing, generics, error handling, or migration to modern TypeScript features.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/typescript-expert
tools
VerifiedTrustedCommunity
Resolves TypeScript and JavaScript problems across type-level programming, performance, monorepo management, migration, and modern tooling. Invoke when diagnosing "type instantiation excessively deep" errors, migrating JS to TS, configuring strict tsconfig, debugging module resolution, or choosing between Biome/ESLint/Turborepo/Nx.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/turborepo
tools
VerifiedTrustedCommunity
Turborepo monorepo build system guidance. Triggers on: `turbo.json`, task pipelines, `dependsOn`, caching, remote cache, the `turbo` CLI, `--filter`, `--affected`, CI optimization, environment variables, internal packages, monorepo structure, and package boundaries. Use when the user configures tasks or workflows, creates packages, sets up a monorepo, shares code between apps, runs changed packages, debugs cache behavior, or works in an `apps/` plus `packages/` workspace.
30SKILL.mdUpdated Jul 14, 2026
shipshitdev/tailwind
tools
VerifiedTrustedCommunity
Provides Tailwind CSS v4 performance optimization and best practices guidelines. Triggers when writing, reviewing, or refactoring Tailwind CSS v4 code; when working with Tailwind configuration, @theme directive, utility classes, responsive design, dark mode, container queries, or CSS generation optimization.
30SKILL.mdUpdated Jul 14, 2026