kevinslin/agstack/dev-can-make-public

Claude Code and agent skill by kevinslin/agstack

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Scan a repo for sensitive data before making it public.

Install

npx vskill@latest install kevinslin/agstack/dev-can-make-public

SKILL.md

Dev.Can-Make-Public

Workflow

  1. Confirm scope
  • Identify the repo root and whether it is a git repository.
  • If git history exists, plan to scan both working tree and history.
  1. Scan working-tree filenames (high-signal)
  • Look for common secret/credential files and key material by filename.
  • Example:
bash
rg --files -g '.env*' -g '*.pem' -g '*.key' -g '*.p12' -g '*.pfx' -g '*.jks' -g '*.keystore' -g '*id_rsa*' -g '*id_ed25519*' -g '*.npmrc' -g '*.pypirc' -g '*credentials*' -g '*secret*' -g '.aws/credentials'
  1. Scan working-tree contents (high-signal patterns)
  • Search for common token formats, private keys, and credential assignments.
  • Redact secret values in any output.
  • Example:
bash
rg -n -S "BEGIN (RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY|PRIVATE KEY-----"
rg -n -S "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z\-_]{35}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|gho_[A-Za-z0-9]{20,}|ghs_[A-Za-z0-9]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk_live_[0-9a-zA-Z]{10,}|rk_live_[0-9a-zA-Z]{10,}|SG\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}|npm_[A-Za-z0-9]{10,}"
rg -n -S "(?i)(api[_-]?key|token|secret|password|passwd|pwd|access[_-]?key|client_secret)\s*[:=]\s*['\"]?[^'\"\s]{6,}"
  1. Scan git history (if repo is git)
  • Check for sensitive filenames in history.
  • Check for sensitive content across all commits.
  • Example:
bash
git rev-parse --is-inside-work-tree
git log --all --name-only --pretty=format: | rg -i "\.env|\.pem|\.key|id_rsa|id_ed25519|credentials|secret|\.p12|\.pfx|\.npmrc|\.pypirc"
 
git rev-list --all | xargs -n 50 git grep -nE "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z\-_]{35}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk_live_[0-9a-zA-Z]{10,}|SG\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}|BEGIN (RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY|PRIVATE KEY-----|(?i)(api[_-]?key|token|secret|password|access[_-]?key|client_secret)\s*[:=]" || true
  1. Assess and report
  • List findings with file path + line number or commit hash.
  • Classify severity (critical: secrets/private keys; medium: internal URLs or IDs; low: metadata).
  • Recommend remediation: remove/replace with placeholders, move to env, add to .gitignore, rotate credentials, and rewrite history only with explicit user approval.

Optional tooling

  • If gitleaks or trufflehog is installed, run it and summarize results.
  • Prefer reporting evidence and recommended fixes over raw secret values.

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
23
7-day trend score
0

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/kevinslin/agstack/dev-can-make-public/badge)](https://verified-skill.com/skills/kevinslin/agstack/dev-can-make-public)

Something wrong with this skill or its page? Tell us.