public-surface-audit

public-surface-audit — Operator-Private Token Leak Scan

Scans the git-tracked file set (the public surface) for operator-private tokens that were supposed to stay in gitignored files (e.g. CLAUDE.local.md, companion store). After a public/private split, a front-door fix is not enough — a leaked username or absolute home path anywhere in the tracked set breaks the "public repo = model-agnostic methodology only" invariant.

While marketplace-gate Check 5 answers "is this repo broadly safe to publish?" (API keys, internal domains, license), public-surface-audit answers a narrower question: "did any operator-private token survive the public/private split into a tracked file?" It scans git ls-files only — gitignored files like CLAUDE.local.md are intentionally out of scope (they are the correct home for these tokens).

Triggers

• /public-surface-audit
• /public-surface-audit --target <repo path>
• /public-surface-audit --json (machine-parseable verdict for hook-gating — see Step 5)
• "Did I leak anything into the public repo?", "public surface audit", "private token scan"
• "Check tracked files for private tokens", "is my public/private split clean?"
• "Did any operator-private token survive into a tracked file?", "scan before publish"

Scope — Tracked Files Only

This skill scans only git ls-files (committed/staged tracked files). Gitignored files are deliberately excluded — CLAUDE.local.md, the companion store, and local session data are the correct home for operator-private tokens, so finding them there is not a leak.

ARGS="${ARGUMENTS//--json/}"            # strip flags first — "--json" alone must not become the path
REPO_PATH="${ARGS#--target }"
REPO_PATH="$(printf '%s' "$REPO_PATH" | xargs)"
REPO_PATH="${REPO_PATH:-$(pwd)}"
git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1 \
  || { echo "Not a git repo — public-surface-audit scans git-tracked files only. Aborting."; exit 1; }
echo "Target: $REPO_PATH"
git -C "$REPO_PATH" ls-files | wc -l | xargs echo "Tracked files:"