Git History Leak Check Lite

Git History Leak Check (Lite)

Scan diff/patch text the user supplies for secret-looking strings in added (+) lines.

Scope and rules

• Scans only added lines of a diff — removed lines and context are ignored.
• Findings are reported by file, line, and masked fingerprint — never print the raw secret.
• A hit means treat the secret as compromised if committed/pushed: recommend rotation, not just removal.
• Zero findings ≠ clean repo — this lite checks one diff, not history.

1. Run

Requires Node 18+, zero dependencies. Feed a diff via file or stdin:

git diff --cached | node <skill-dir>/scripts/leak.js -
git diff HEAD~1 | node <skill-dir>/scripts/leak.js -
node <skill-dir>/scripts/leak.js patch.diff

JSON on stdout; exit 1 on findings, 2 on usage/read error.

2. Read the report

• findings[]: file, line, pattern (e.g. aws-access-key, generic-api-key, private-key-block), fp masked fingerprint.
• filesScanned / addedLines.

3. Deliver

List findings with file:line and pattern. For each: rotate the credential, then remove it — and note that committed secrets stay in history (full version scans history; tools like git filter-repo or GitHub's purge flow remove them).

Lite vs full

The full git-history-leak-check walks the entire git history (git log -p), attributes leaks to commits, and produces a rotation checklist per secret.

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for this skill. Ratings decide marketplace placement.