repo-sentinel

Everything in a public repo is permanent attacker surface. This skill defines what belongs in a public repo, what does not, how to detect violations across 12 attack surfaces, how to remediate when the boundary is violated, and how to enforce continuously.

This skill uses bundled reference files for detailed patterns and templates. Read them as needed:

| references/scan-patterns.md | When running any audit (fast-path or full) — contains all detection commands | | references/templates.md | When setting up enforcement, generating .gitignore, or creating CI gates | | references/remediation.md | When fixing findings or scrubbing history — contains all fix procedures |

Full security audit and enforcement for public repositories across 12 attack surfaces: git history, source code, docs, config, .gitignore recon, CI/CD, containers, dependencies, binaries, metadata, platform-specific (GitHub/GitLab), license compliance, and community surface. Provides fast-path and full 20-check audits, pre-commit hooks, CI gates, .gitignore generation, and history scrubbing. Use whenever pushing to a public remote, open-sourcing a repo, writing README/docs, configuring CI/CD or Dockerfiles, adding dependencies, or checking license compliance. Trigger on: push to GitHub, make repo public, open source this, set up the repo, write README, add CI/CD, create Dockerfile, set up pre-commit, add license, write SECURITY.md, secret leaks, credential rotation, .claude/ tracking, repo hygiene, security scanning, or is this safe to push, pre-oss, open source readiness, release audit, or open source audit. This is the gatekeeper between internal and public. Source: mathews-tom/praxis-skills.