agentsclimarketplace

Regitize sensitive scan

Skill gadost/regitize/skills/regitize-sensitive-scan

Portable AI-agent skills for auditing and improving Git history

Install
npx -y skills add gadost/regitize --skill regitize-sensitive-scan

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 27 days oldThe repository was created 27 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit every reachable Git history blob for high-confidence secret patterns and oversized files without exposing matched values or changing repository state. Use when the user invokes regitize-sensitive-scan, asks to scan historical commits before publishing, wants to find leaked credentials in Git history, or needs an oversized-blob inventory.

SKILL.md

2.2 KB, as published. Nobody here has run it

Regitize Sensitive Scan

Scan all refs by default and produce a redacted evidence report. Do not rewrite history or revoke credentials automatically.

Workflow

  1. Locate this skill directory and verify the target is a Git repository.
  2. Run node <skill-dir>/scripts/scan-history.mjs. Use --large-mb <n> only when the user supplies another threshold; the default is 5 MiB. Use --rev <ref> only when scope is explicitly limited.
  3. Read the generated JSON report completely. For each secret finding, inspect surrounding repository context with the blob ID and path without printing the matched value. Treat generic assignments as candidates requiring review.
  4. Classify findings as confirmed, likely, or false positive. Treat private keys and recognizable provider tokens as confirmed unless repository evidence proves they are fixtures.
  5. Present counts, affected paths, blob IDs, line numbers, rule names, and oversized files. Never reproduce secret text; use the report fingerprint.
  6. Recommend immediate credential revocation/rotation for confirmed live secrets before any history rewrite. Explain that deleting a file in a later commit does not remove it from prior history.
  7. If the user requests remediation, propose an independent rewrite plan using an appropriate history-filtering tool. Do not broaden this scan-only skill into an automatic destructive rewrite.

Safety rules

  • Do not print, store, or transmit matched credential values.
  • Do not claim a secret is inactive without provider-side evidence.
  • Do not modify refs, files, remotes, or credential systems.
  • Report skipped blobs larger than the content-scan limit; an oversized report is not proof that their contents are safe.

See references/detection.md for rule scope and triage guidance.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.