How do I install the Git Safety skill?

Run npx skillmds@latest add shipshitdev/git-safety-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Git Safety safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Git Safety?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Git Safety free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Git Safety?

shipshitdev (@shipshitdev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Git Safety by shipshitdev — Agent Skill

Name: Git Safety
Author: shipshitdev

Git Safety

Scans, cleans, and prevents secrets in git history across four modes: scan (detect sensitive files in the current state and history), clean (rewrite history to remove secrets using git-filter-repo or BFG), prevent (add .gitignore and pre-commit hooks), and full (all three in sequence). Use when the user asks to check for leaked credentials, scrub a secret from git history, force-push a cleaned repo, set up pre-commit secret prevention, or run a full git security audit.

shipshitdev 591d0bb 3 files · 12.5 KB Updated Sep 17, 2026

File contents

Git Safety Skill

Comprehensive security scanning, cleaning, and prevention for git repositories.

Contract

Inputs:

Repository root
Mode: scan, prevent, clean, or full
Optional leaked path, secret pattern, or affected ref range

Outputs:

Sensitive file/history findings
Rotation and remediation checklist
Commands required for prevention or history cleanup

Creates/Modifies:

Scan mode: no file changes
Prevent mode: .gitignore and optional hook updates
Clean mode: rewritten git history only after explicit confirmation

External Side Effects:

May force-push rewritten history in clean mode
May require credential rotation outside the repository

Confirmation Required:

Before history rewriting
Before force-pushing
Before changing hooks or ignore rules in shared repos

Delegates To:

security-audit for broader application-security review
open-source-checker before publishing a private repo

CRITICAL WARNING

Removing secrets from git history does NOT make them safe!

Even after cleaning git history:

GitHub is scraped by bots within seconds of a push
Archive services may have captured snapshots
Forks retain the original history
CI/CD logs may contain the values

ALWAYS rotate leaked credentials immediately. Cleaning history is NOT enough.

Modes of Operation

1. `/git-safety scan` - Detect Sensitive Files

Scan repository for sensitive files in current state and git history.

2. `/git-safety clean` - Remove from History

Remove sensitive files using git-filter-repo or BFG.

3. `/git-safety prevent` - Set Up Prevention

Configure .gitignore and pre-commit hooks.

4. `/git-safety full` - Complete Audit

Run all three operations in sequence.

Sensitive File Patterns

.env, .env.*, credentials.json, service-account*.json
*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret

Quick Commands

Scan for sensitive files in history:

git log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'

Remove .env from all history:

git filter-repo --path .env --invert-paths --force
git push origin --force --all

Add to .gitignore:

echo -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore

Emergency Response

If you've leaked credentials:

IMMEDIATELY rotate the credential
Check access logs
Run /git-safety clean
Force push cleaned history
Notify team to re-clone
Update .gitignore
Set up pre-commit hooks

For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see: references/full-guide.md

---name: git-safety-2description: Scans, cleans, and prevents secrets in git history across four modes: scan (detect sensitive files in the current state and history), clean (rewrite history to remove secrets using git-filter-repo or BFG), prevent (add .gitignore and pre-commit hooks), and full (all three in sequence). Use when the user asks to check for leaked credentials, scrub a secret from git history, force-push a cleaned repo, set up pre-commit secret prevention, or run a full git security audit.---# Git Safety SkillComprehensive security scanning, cleaning, and prevention for git repositories.## ContractInputs:- Repository root- Mode: scan, prevent, clean, or full- Optional leaked path, secret pattern, or affected ref rangeOutputs:- Sensitive file/history findings- Rotation and remediation checklist- Commands required for prevention or history cleanupCreates/Modifies:- Scan mode: no file changes- Prevent mode: `.gitignore` and optional hook updates- Clean mode: rewritten git history only after explicit confirmationExternal Side Effects:- May force-push rewritten history in clean mode- May require credential rotation outside the repositoryConfirmation Required:- Before history rewriting- Before force-pushing- Before changing hooks or ignore rules in shared reposDelegates To:- `security-audit` for broader application-security review- `open-source-checker` before publishing a private repo## CRITICAL WARNING**Removing secrets from git history does NOT make them safe!**Even after cleaning git history:- GitHub is scraped by bots within seconds of a push- Archive services may have captured snapshots- Forks retain the original history- CI/CD logs may contain the values**ALWAYS rotate leaked credentials immediately.** Cleaning history is NOT enough.## Modes of Operation### 1. `/git-safety scan` - Detect Sensitive FilesScan repository for sensitive files in current state and git history.### 2. `/git-safety clean` - Remove from HistoryRemove sensitive files using git-filter-repo or BFG.### 3. `/git-safety prevent` - Set Up PreventionConfigure .gitignore and pre-commit hooks.### 4. `/git-safety full` - Complete AuditRun all three operations in sequence.## Sensitive File Patterns```.env, .env.*, credentials.json, service-account*.json*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret```## Quick Commands**Scan for sensitive files in history:**```bashgit log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'```**Remove .env from all history:**```bashgit filter-repo --path .env --invert-paths --forcegit push origin --force --all```**Add to .gitignore:**```bashecho -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore```## Emergency ResponseIf you've leaked credentials:1. **IMMEDIATELY rotate the credential**2. Check access logs3. Run `/git-safety clean`4. Force push cleaned history5. Notify team to re-clone6. Update .gitignore7. Set up pre-commit hooks---**For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see:** `references/full-guide.md`

Frequently asked questions