How do I install the Git Safety skill?

Run npx skillmds@latest add shipshitdev/git-safety-3 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Git Safety safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Git Safety?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Git Safety free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Git Safety?

shipshitdev (@shipshitdev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Git Safety by shipshitdev — Agent Skill

Name: Git Safety
Author: shipshitdev

Git Safety

Scan git history for sensitive files, clean leaked credentials, and set up prevention measures. Use when asked to "check for secrets", "scan git history", "remove .env from history", "secure my repo", or "clean sensitive files".

shipshitdev Updated Sep 21, 2026

File contents

Git Safety Skill

Comprehensive security scanning, cleaning, and prevention for git repositories.

CRITICAL WARNING

Removing secrets from git history does NOT make them safe!

Even after cleaning git history:

GitHub is scraped by bots within seconds of a push
Archive services may have captured snapshots
Forks retain the original history
CI/CD logs may contain the values

ALWAYS rotate leaked credentials immediately. Cleaning history is NOT enough.

Modes of Operation

1. `/git-safety scan` - Detect Sensitive Files

Scan repository for sensitive files in current state and git history.

2. `/git-safety clean` - Remove from History

Remove sensitive files using git-filter-repo or BFG.

3. `/git-safety prevent` - Set Up Prevention

Configure .gitignore and pre-commit hooks.

4. `/git-safety full` - Complete Audit

Run all three operations in sequence.

Sensitive File Patterns

.env, .env.*, credentials.json, service-account*.json
*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret

Quick Commands

Scan for sensitive files in history:

git log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'

Remove .env from all history:

git filter-repo --path .env --invert-paths --force
git push origin --force --all

Add to .gitignore:

echo -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore

Emergency Response

If you've leaked credentials:

IMMEDIATELY rotate the credential
Check access logs
Run /git-safety clean
Force push cleaned history
Notify team to re-clone
Update .gitignore
Set up pre-commit hooks

For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see: references/full-guide.md

---name: git-safety-3description: Scan git history for sensitive files, clean leaked credentials, and set up prevention measures. Use when asked to "check for secrets", "scan git history", "remove .env from history", "secure my repo", or "clean sensitive files".---# Git Safety SkillComprehensive security scanning, cleaning, and prevention for git repositories.## CRITICAL WARNING**Removing secrets from git history does NOT make them safe!**Even after cleaning git history:- GitHub is scraped by bots within seconds of a push- Archive services may have captured snapshots- Forks retain the original history- CI/CD logs may contain the values**ALWAYS rotate leaked credentials immediately.** Cleaning history is NOT enough.## Modes of Operation### 1. `/git-safety scan` - Detect Sensitive FilesScan repository for sensitive files in current state and git history.### 2. `/git-safety clean` - Remove from HistoryRemove sensitive files using git-filter-repo or BFG.### 3. `/git-safety prevent` - Set Up PreventionConfigure .gitignore and pre-commit hooks.### 4. `/git-safety full` - Complete AuditRun all three operations in sequence.## Sensitive File Patterns```.env, .env.*, credentials.json, service-account*.json*.pem, *.key, id_rsa*, secrets.*, .npmrc, *.secret```## Quick Commands**Scan for sensitive files in history:**```bashgit log --all --pretty=format: --name-only --diff-filter=A | sort -u | grep -iE 'env|secret|credential|key'```**Remove .env from all history:**```bashgit filter-repo --path .env --invert-paths --forcegit push origin --force --all```**Add to .gitignore:**```bashecho -e "\n.env\n.env.*\n*.pem\n*.key\ncredentials.json" >> .gitignore```## Emergency ResponseIf you've leaked credentials:1. **IMMEDIATELY rotate the credential**2. Check access logs3. Run `/git-safety clean`4. Force push cleaned history5. Notify team to re-clone6. Update .gitignore7. Set up pre-commit hooks---**For complete scan commands, cleaning process with git-filter-repo/BFG, pre-commit hook setup, .gitignore templates, platform-specific guidance, and detailed emergency checklist, see:** `references/full-guide.md`

Frequently asked questions