shipshitdev/open-source-checker
skills/open-source-checker/SKILL.md
Expert in detecting private information, secrets, API keys, credentials, and sensitive data in codebases before open sourcing. Use when preparing to open source a repository, reviewing code for exposed secrets, or auditing a codebase for sensitive data before public release.
$ install --global
skillsauthnpx skillsauth add shipshitdev/library open-source-checkerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 14, 2026, 4:49 AM186.5s3 files scanned
SKILL.md
- name:
- open-source-checker
- description:
- Expert in detecting private information, secrets, API keys, credentials, and sensitive data in codebases before open sourcing. Use when preparing to open source a repository, reviewing code for exposed secrets, or auditing a codebase for sensitive data before public release.
- version:
- 1.0.1
- tags:
- open-source, security, secrets
Open Source Checker
When to Use
Use when you're:
- Preparing to open source a repository
- Reviewing code for exposed secrets
- Auditing codebase for sensitive data
- Performing security audits before public release
- Setting up pre-commit hooks for secret detection
What to Check
Critical Items
- API keys (OpenAI, Stripe, AWS, GitHub tokens)
- Database credentials and connection strings
- Private keys and certificates (
.pem,.key) - Personal information (emails, phone numbers)
- Environment files (
.envshould be gitignored)
Git History (CRITICAL)
- Secrets remain in git history even after deletion
- Must scan all branches, tags, and deleted files
- Use
gitleaks,truffleHog, orgit-secrets
Quick Workflow
- File scan: Check for secret files, patterns
- Code analysis: Search for hardcoded secrets
- Git history: Scan entire history with tools
- Setup hooks: Prevent future commits with secrets
- Clean history: Use
git-filter-repoif needed
Tools
gitleaks: Best for git history scanningtruffleHog: Alternative history scannergit-secrets: AWS-focused with pre-commit hooksdetect-secrets: Baseline-based detection
References
- Full guide: Patterns, scanning workflow, git hooks, cleanup
Related Skills
shipshitdev/weekly-review
development
VerifiedTrustedCommunity
Coordinates a weekly engineering review of board accuracy, recent code changes, operational health, and scoped cleanup. Use for a recurring repository health review or a review of the last several days.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/project-board
testing
VerifiedTrustedCommunity
Audits project board configuration and prepares explicitly requested setup, copy, or normalization changes while preserving the existing workflow and provider boundaries. Use when inspecting a board's fields, columns, scope, or configuration.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/board-sync
testing
VerifiedTrustedCommunity
Reconciles a project board with current work and delivery evidence, reports incomplete coverage and metadata gaps, and applies only approved provider-supported field changes. Use when auditing board drift, reviewing blocked work, or assessing upcoming delivery.
35SKILL.mdUpdated Sep 6, 2026
shipshitdev/how
development
VerifiedTrustedCommunity
Walk through how a subsystem works. Use for "how does X work", code walkthroughs before changing something, and placement or ownership questions. Explains architecture, runtime flow, and onboarding mental models. Can critique architecture. Use why for motivation.
35SKILL.mdUpdated Aug 31, 2026