Secure gitignore management

Skill meyverick/agy-skills/skills/secure-gitignore-management

Manages and audits .gitignore files. Use when evaluating codebase security to strictly enforce a default-deny pattern for tracking files.From its SKILL.md

Install

npx -y skills add meyverick/agy-skills --skill secure-gitignore-management

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 573 tokens by cl100k_base, as published. Nobody here has run it

Secure Gitignore Management

This skill enforces a highly secure "default-deny" Git ignore strategy. It prevents accidental credential leaks, environmental configuration leaks, and compilation artifact bloat by strictly allowing only verified source files into the index.

When to Use

Use when initializing a new repository (git init).
Use when auditing the repository for accidentally committed credentials.
Use when modifying the project's build toolchain or adding new environment variable architectures.
NOT for modifying .git/ internal core configurations.

Core Process

Phase 1: The Default-Deny Architecture

Instead of listing everything you don't want, a secure .gitignore lists everything, then selectively allows what you do want.

Add * to the very top of .gitignore to ignore everything.
Add !*/ to allow directories.

Phase 2: Selective Allow-Listing

Specifically allow your source code directories and configuration files.

!src/
!docs/
!package.json
!README.md

Phase 3: Explicit Security Blocks

Even within allow-listed directories, ensure absolute strict bans on sensitive patterns:

**/*.env
**/*.pem
**/*_rsa
**/*.sqlite (unless explicitly intended for distribution)

Phase 4: Git Index Verification

Verify what Git is actually tracking to ensure no secrets slipped through before the policy was enacted.

Execute git ls-files to audit currently tracked files.
If a sensitive file is tracked, execute git rm --cached <file> immediately.

Common Rationalizations

Rationalization	Reality
"A default-deny gitignore is too annoying to maintain."	Accidentally leaking AWS keys or database credentials is far more painful. Explicit tracking forces intentional engineering.
"I'll just add `.env` to the end of the file."	Without a default-deny pattern, developers inevitably name a secret `.env.local` or `.env.test` which slips through the standard blocklist.

Red Flags

.gitignore files that do not start with a universal block (*).
Tracking files named secrets.json, .env, or ending in .key.
Committing heavy compilation artifacts (e.g., node_modules/, dist/).

Verification

Before finalizing Gitignore management, verify:

.gitignore implements a default-deny * rule.
git ls-files returns zero sensitive credentials, API keys, or .env files.
Explicit allow-lists cover only necessary source and configuration files.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most security skills give in 573 tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-07

Parameterize all database queriesin 68 of 648, across 51 files
Hash passwords using bcrypt, scrypt, or argon2in 49 of 648, across 36 files
Apply rate limiting to authentication endpointsin 48 of 648, across 24 files
Configure security headersin 35 of 648, across 19 files
Validate all inputsin 32 of 648, across 24 files
Validate all external input at the system boundaryin 29 of 648, across 19 files
Run containers as a non-root userin 28 of 648, across 15 files
Use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
Run dependency audits before every releasein 21 of 648, across 10 files
Encode output to prevent cross-site scriptingin 21 of 648, across 11 files
Copy dependencies before source codein 20 of 648, across 9 files
Store secrets in environment variablesin 20 of 648, across 18 files

Said here and by no other author read

add a universal block to the top
explicitly allow only necessary source directories
block sensitive file patterns
verify the git index for tracked secrets
remove tracked sensitive files from git
use a default-deny ignore strategy

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.