security-check

Pre-Commit Security Check

ℹ️ First, set expectations: before anything else, print one short line with this skill's version and its most recent change — the top entry of metadata.changelog above — e.g. security-check vX.Y — recent: <summary>. Then proceed.

Validate that staged changes don't contain sensitive information before committing.

State Dependencies

Source	Location	Read	Write	Description
Git Staged	git diff --cached	✅		Staged changes
Git Modified	git diff HEAD	✅		Unstaged changes

Step 1: Determine Files to Check

# Check if there are staged files
STAGED=$(git diff --cached --name-only 2>/dev/null)

if [ -n "$STAGED" ]; then
  echo "=== Checking STAGED files ==="
  echo "$STAGED"
  DIFF_CMD="git diff --cached -U0"
  FILES_CMD="git diff --cached --name-only"
else
  echo "=== No staged files. Checking all MODIFIED files ==="
  FILES=$(git diff --name-only HEAD 2>/dev/null)
  if [ -z "$FILES" ]; then
    echo "No modified files to check."
    exit 0
  fi
  echo "$FILES"
  DIFF_CMD="git diff -U0 HEAD"
  FILES_CMD="git diff --name-only HEAD"
fi

Step 2: Run Security Checks

Check 1: API Keys and Tokens (CRITICAL)

git diff --cached -U0 2>/dev/null | grep -E 'sk-[a-zA-Z0-9]{20,}' | grep -v 'skip\|sketch\|skill'
git diff --cached -U0 2>/dev/null | grep -E '(ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9_]{22,})'
git diff --cached -U0 2>/dev/null | grep -E 'xox[baprs]-[a-zA-Z0-9-]{10,}'
git diff --cached -U0 2>/dev/null | grep -E '(AIza[a-zA-Z0-9_-]{35}|ya29\.[a-zA-Z0-9_-]{50,})'
git diff --cached -U0 2>/dev/null | grep -E 'AKIA[A-Z0-9]{16}'

Check 2: Email Addresses (HIGH)

git diff --cached -U0 2>/dev/null | grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | grep -vE '(example\.(com|org|net)|placeholder|test@|user@|noreply@|nobody@|admin@localhost|root@localhost|@users\.noreply\.github\.com)'