git-guardian

🛡️ Git Guardian

Compatible with Claude Code, Codex CLI, Cursor, Windsurf, and any SKILL.md-compatible agent.

Pre-commit safety checks built for AI-assisted development. AI agents generate code fast — sometimes too fast. Git Guardian catches secrets, sensitive files, merge conflicts, and common AI mistakes before they land in your history.

---

Triggers

Activate this skill when:

• "check before commit", "is this safe to commit", "pre-commit check"
• "any secrets in staged files?", "check for API keys"
• About to commit AI-generated code
• "run git guardian", "safety check", "audit staged changes"
• After a large AI-generated code dump, before pushing
• User sets up a new repo and wants pre-commit safety

---

The Full Check Suite

Run these checks against staged changes (or a specified path). Report findings with severity: 🔴 BLOCK, 🟡 WARN, 🔵 INFO.

---

Check 1: Secret Detection 🔴

Patterns that indicate leaked credentials:

# Check staged files for secrets
git diff --cached --name-only | while read f; do
  echo "=== $f ==="
  git show ":$f" 2>/dev/null
done | grep -inE \
  'api[_-]?key|apikey|api[_-]?secret|\
secret[_-]?key|secret[_-]?token|\
auth[_-]?token|access[_-]?token|bearer[_-]?\
private[_-]?key|ssh[_-]?key|rsa[_-]?private|\
password\s*=\s*["\x27][^\x27"]{6,}|\
passwd\s*=\s*["\x27][^\x27"]{6,}|\
aws_access_key_id|aws_secret_access_key|\
AKIA[0-9A-Z]{16}|\
ghp_[a-zA-Z0-9]{36}|github_pat_|\
sk-[a-zA-Z0-9]{32,}|\
xoxb-|xoxa-|xoxp-|\
glpat-|glcpat-|\
npm_[a-zA-Z0-9]{36}|\
-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY'

High-risk literal patterns to check for:

# Check for raw high-entropy strings (possible tokens/keys)
git diff --cached | grep "^+" | grep -vE "^(\\+\\+\\+)" | \
  grep -E '[a-zA-Z0-9+/]{40,}={0,2}' | \
  grep -vE '(hash|sha|digest|checksum|fingerprint|base64|encoded|example|placeholder|YOUR_|REPLACE_|<.*>)' | \
  head -20

Common secret formats by provider:

Provider	Pattern	Example prefix
OpenAI	sk-[a-zA-Z0-9]{48}	sk-proj-...
Anthropic	sk-ant-[a-zA-Z0-9-]{95}	sk-ant-api03-...
GitHub	ghp_[a-zA-Z0-9]{36}	ghp_abc...
AWS	AKIA[A-Z0-9]{16}	AKIAIOSFODNN7...
Google API	AIza[0-9A-Za-z-_]{35}	AIzaSy...
Slack	xoxb-[0-9-]{50,}	xoxb-123-...
Stripe	sk_live_[a-zA-Z0-9]{24}	sk_live_...
Twilio	SK[a-zA-Z0-9]{32}	SK1234...
JWT	eyJ[a-zA-Z0-9-_]+\.[a-zA-Z0-9-_]+\.	eyJhbGc...