# Wip Repo Permissions Hook

> Repo visibility guard. Blocks repos from going public without a -private counterpart.

- Skill: `wipcomputer-wip-ai-devops-toolbox/wip-repo-permissions-hook` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add wipcomputer-wip-ai-devops-toolbox/wip-repo-permissions-hook`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wipcomputer-wip-ai-devops-toolbox/wip-repo-permissions-hook/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: wipcomputer (https://skillmd.com/u/wipcomputer-wip-ai-devops-toolbox)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/wipcomputer-wip-ai-devops-toolbox/wip-repo-permissions-hook

---


# Repo Permissions Hook

## What This Does

Prevents repos from being made public unless a `-private` counterpart exists on GitHub. Protects internal plans, todos, and development context from accidental exposure.

## The Rule

Every repo that goes public must have a `{name}-private` repo. The private repo holds `ai/` folders with plans, todos, dev updates, and notes. The public repo has the same code without `ai/`.

Forks of external projects are exempt.

## How to Use

### Check before changing visibility
```bash
node cli.js check <org>/<repo>
```

### Audit all public repos
```bash
node cli.js audit <org>
```

### Install as Claude Code hook
Add to `~/.claude/settings.json` under `hooks.PreToolUse` with matcher `"Bash"`.

### Install as OpenClaw plugin
Copy to `~/.ldm/extensions/wip-repo-permissions-hook/` and restart gateway.

### MCP

Tools: `repo_permissions_check`, `repo_permissions_audit`

Add to `.mcp.json`:
```json
{
  "wip-repo-permissions": {
    "command": "node",
    "args": ["/path/to/tools/wip-repo-permissions-hook/mcp-server.mjs"]
  }
}
```