agentleFS
Sign inStart free
SamuelNDCESamuelNDCE/ai-workbench/skills/pre-push-secret-scan/SKILL.md

Pre-Push Secret Scan

Skill1 starsChanged 4 months agoMITView on GitHub

Quick local scan for API keys, tokens, webhook URLs, and credentials before any git push. Lightweight, automatic, every push, the fast everyday sibling of full-account-security-audit. Use right before pushing any commit.

  • Reads credentials
  • Commits and pushes

The file

We split this skill into the rules it gives an agent

3 rules. About 0 are common, 0 are distinctive, and 3 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Run the battery against what's actually about to be pushed, not the whole repo (that's full-account-security-audit's job).

    line 32
  2. Very specific:

    If real: remove it, rotate the credential if it was ever pushed before (even to a private repo), and check whether it needs a history …

    line 34
  3. Very specific:

    If it's a .env file: confirm it's gitignored and was never tracked (git log --diff-filter=A -- .env should return nothing).

    line 35

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Pre-Push Secret Scan

Runs in seconds, before every push, not just when something feels risky. Cheap insurance against the exact mistake already logged once: a Discord webhook URL committed straight into a public repo.

The pattern battery

Grep the diff about to be pushed (git diff origin/<branch>..HEAD or the staged changes) for:

sk-ant-           # Anthropic keys
sk-proj-          # OpenAI project keys
ghp_ | github_pat_ # GitHub tokens
AKIA              # AWS access keys
shpat_            # Shopify access tokens
AIza              # Google API keys
xox[baprs]-       # Slack tokens
discord.com/api/webhooks/   # Discord webhook URLs
hf_               # Hugging Face tokens
-----BEGIN.*PRIVATE KEY-----
eyJ[A-Za-z0-9_-]{10,}\.eyJ  # JWT shape

Plus a generic pass for hardcoded credentials: (key|secret|password|token)\s*[:=]\s*["'][^"']{8,}["'], filtering out obvious placeholders (your-key-here, xxx, <...>, .example files).

Procedure

  1. Run the battery against what's actually about to be pushed, not the whole repo (that's full-account-security-audit's job).
  2. Any hit: stop, do not push. Determine if it's a real secret or a placeholder/test fixture (e.g. an intentional fake key in a test file, clearly labeled).
  3. If real: remove it, rotate the credential if it was ever pushed before (even to a private repo), and check whether it needs a history rewrite (public-repo-leak-retraction) rather than just a follow-up commit. A follow-up commit does not remove it from history.
  4. If it's a .env file: confirm it's gitignored and was never tracked (git log --diff-filter=A -- .env should return nothing).

Relationship to the other repo-hygiene skills

  • This one: fast, runs on every push, catches it before it happens.
  • full-account-security-audit: slow, comprehensive, periodic, sweeps everything that already exists.
  • public-repo-leak-retraction: reactive, something already got through both of the above and needs to come out of history entirely.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free