public repo preflight

Deleting a sensitive file from your latest commit does not remove it from Git history. When a repository goes public, every past version of every file becomes accessible to the world. This skill audits your local repository to find secrets, personal data, and oversized blobs buried in the logs before they reach a public remote.

What it does

• Secret detection scans current files and past commits for API keys, passwords, and private key blocks using pattern matching.
• Privacy audit identifies home directory paths, personal email addresses, and specific names or workplaces within the code and commit signatures.
• History inspection targets deleted files and past versions that still exist in the Git object database.
• Bloat analysis flags files over 10 MB and large objects in the history that could trigger GitHub's upload limits.
• License verification checks for the presence of a LICENSE file and ensures it aligns with project documentation.

How it works

1. Initial survey runs basic Git diagnostics to count commits and check for uncommitted changes.
2. Context gathering asks for specific names or terms that must remain private to customize the search.
3. Deep scan executes read-only Git commands to analyze the current tree and the full commit history.
4. Impact reporting generates a prioritized table of findings including the specific location and the safest remediation path.

Frameworks & tools

This skill uses standard Git CLI commands such as git rev-list, git log -G, and git cat-file. It works with any repository regardless of the programming language or framework.

Why this beats prompting it yourself

Standard prompts often forget that Git history is immutable by default. This skill systematically searches through deleted objects and past diffs that a simple file search would miss. It follows a strict read-only protocol to ensure your repository state is never accidentally altered during the audit.

Use cases

• Auditing a private enterprise project before open-sourcing it to the community.
• Checking a new repository before the very first push to a public GitHub remote.
• Identifying why a repository has become unexpectedly large and difficult to clone.
• Verifying that sensitive .env data hasn't been accidentally committed in a previous sprint.

Known limitations

This skill is read-only and will not perform the actual history rewrites or secret rotations. It cannot detect secrets inside compressed archives or binary files.