Scrub public artifact
Skill workingclassbuddha/codexmaxxing/skills/scrub-public-artifact
UI skills for Codex: design passes, browser automation, screenshots, responsive checks, and evidence packs.
npx -y skills add workingclassbuddha/codexmaxxing --skill scrub-public-artifactAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Review projects, docs, screenshots, demos, prompts, and repositories before sharing or publishing. Use when Codex needs to remove secrets, personal paths, private URLs, internal names, proprietary strategy, customer data, credentials, tokens, API keys, or company-sensitive implementation details while preserving a useful public or private GitHub artifact.
SKILL.md
1.9 KB, as published. Nobody here has run it
Scrub Public Artifact
Use this skill before pushing, sharing, exporting, or publishing work. The goal is not to make the artifact empty; it is to keep useful general material while removing private value and operational risk.
Workflow
- Identify the sharing target: private GitHub, public GitHub, investor/customer deck, screenshot, blog/demo, or internal handoff.
- Scan text files and docs for secrets, private paths, internal names, credentials, raw logs, tokens, and unreleased strategy.
- Check images/screenshots for visible keys, private URLs, local paths, names, account IDs, terminal output, and dashboards.
- Replace sensitive specifics with generic labels such as
local runtime,private repo,internal service, orexample.com. - Preserve reusable patterns, workflows, tests, and public-safe examples.
- Report what was removed, what was generalized, and what remains risky.
Safety Rules
- Never paste detected secrets back into chat.
- Do not commit
.env, key files, raw browser profiles, build credentials, private logs, database dumps, or generated cache folders. - Treat company-specific architecture, runtime contracts, economics, customer data, and strategic positioning as sensitive unless the user explicitly says otherwise.
- For private GitHub, still scrub credentials and personal/private tokens. "Private" is not a vault.
Resources
- Run
scripts/sensitive_scan.py <path>for a lightweight text scan. - Read
references/publication-checklist.mdfor the manual review checklist.