agentsclimarketplace

Git secret remediation

Skill POWR-DATA/mtx-skills/skills/infra/git-secret-remediation

Reusable AI agent skills for application development, data, architecture, domain modelling and delivery workflows.

Install
npx -y skills add POWR-DATA/mtx-skills --skill git-secret-remediation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Remove committed secrets from Git history safely and verify remediations across local and remote repositories

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.9 KB, 785 tokens by cl100k_base, as published. Nobody here has run it

Git Secret Remediation

Purpose

Remove accidentally committed secrets from Git history in a controlled, auditable way. This skill covers rewriting history, handling cross-platform text replacement pitfalls, and validating that sensitive values are removed from both local and remote history.

When to use

  • Secrets, tokens, keys, or passwords were committed to Git
  • .env or config files with sensitive values entered repository history
  • A history rewrite is required before a repository is shared broadly
  • Rotated credentials still need forensic cleanup from Git objects

Inputs expected

  • Repository path and affected branches/tags
  • Secret patterns to remove (exact values, regex-safe tokens, file paths)
  • Preferred rewrite tooling (git filter-repo)
  • Coordination constraints (team members, CI, forks, mirrors)

Guiding principles

  • Rotate first, rewrite second. Credential rotation reduces immediate risk while history cleanup is prepared.
  • Use deterministic replacement rules. Build an explicit replacement map and verify exact matching before rewrite.
  • Windows encoding can silently break replacement maps. In Windows PowerShell, Set-Content -Encoding UTF8 writes a BOM that can prevent git filter-repo --replace-text matches.
  • Write replacement files as BOM-free UTF-8. Use .NET UTF-8 encoding with BOM disabled to avoid hidden prefix bytes.
  • Treat force-push as a coordinated change event. Notify collaborators and require fresh clones or hard resets after rewrite.

Process

  1. Contain exposure. Rotate compromised credentials and revoke old tokens.
  2. Scope contamination. Identify affected commits, branches, tags, and file patterns.
  3. Create replacement rules file. Build git filter-repo --replace-text mappings for each secret.
  4. Write replacement file safely on Windows. Use BOM-free UTF-8 writing to avoid no-op rewrites.
  5. Run git filter-repo. Rewrite history across required refs.
  6. Verify rewrite success. Search full history and reflog for leaked values.
  7. Force-push rewritten refs. Push all updated branches/tags and communicate reset instructions.
  8. Harden against recurrence. Add ignore rules, pre-commit secret scanning, and checklist updates.

Output format

  1. Incident scope summary - what leaked and where
  2. Replacement rule file - reproducible redaction mappings
  3. Rewrite command log - exact commands run and refs touched
  4. Verification report - proof that leaked values are absent post-rewrite
  5. Recovery actions - collaborator reset instructions and prevention controls

Quality checklist

  • Compromised credentials were rotated before history rewrite
  • Replacement rules were validated against known leaked samples
  • Replacement file is BOM-free UTF-8 (especially on Windows)
  • Rewritten history was verified across branches and tags
  • Remote force-push completed for all affected refs
  • Team reset instructions were distributed and acknowledged

Avoid

  • Rewriting history before rotating credentials.
  • Using broad regex that can over-redact legitimate content.
  • Writing replace-text files with UTF-8 BOM on Windows PowerShell.
  • Assuming local rewrite is enough without remote force-push coordination.

Example usage

A secret was committed and merged into multiple branches. Help me run a safe git filter-repo remediation workflow on Windows, including a BOM-free replace-text file, verification commands, and collaborator recovery steps.

Source: This skill is sourced from the Matrix Skills library. Learn more at the AI Agent Skills Library.

What ships with it: 3 files

3.8 KB alongside SKILL.md

Gives 0 of the 12 instructions most pr commit review skills give in 785 tokens

Counted across 888 of the 1,342 authors here whose files we hold, read 2026-08-07

  • Use conventional commits formatin 127 of 888, across 115 files
  • Keep subject line under 72 charactersin 62 of 888, across 48 files
  • Delete branches after mergein 51 of 888, across 38 files
  • Use imperative mood in subject linein 51 of 888, across 42 files
  • Use imperative mood in commit messagesin 44 of 888
  • Verify directory is ignored before creating worktreein 43 of 888, across 12 files
  • Generate a conventional commit messagein 43 of 888
  • Add unignored worktree directories to gitignorein 42 of 888, across 10 files
  • Make atomic commitsin 39 of 888, across 27 files
  • Run tests before committingin 36 of 888, across 25 files
  • Verify clean test baselinein 35 of 888, across 9 files
  • Split unrelated changes into separate commitsin 35 of 888, across 30 files

Said here and by no other author read

  • identify affected commits, branches, tags, and file patterns
  • build a replacement rules file for each secret
  • write the replacement file as BOM-free UTF-8
  • rewrite history across required refs
  • verify rewritten history is absent of leaked values
  • force-push all rewritten branches and tags

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.