Agent skill · software engineering · daymade
github-sensitive-data-cleanup
Scans and removes sensitive data (secrets, API keys, private domains/IPs, PII) from GitHub repository history, then verifies and force-pushes safely. Use for 清理敏感数据 / 历史重写 / 泄露, "scan sensitive data", "clean git history", "remove secrets from repo", or before any force push to a public repo. Not for local-only Git recovery (use git-safety-net) or ordinary repository setup (use auto-repo-setup).
Why this skill is useful
Adds 4 executable scripts for scanning, rewriting, verifying, and safely pushing Git history that aren't in public docs.
What it needs
Requires gh, git-filter-repo, gitleaks installed locally. About 11k tokens when loaded. Last updated 2026-08-07. 1,320 stars on the source repository.
What this skill does
GitHub Sensitive Data Cleanup Overview This skill guides you through safely removing sensitive data from a Git repository's history and pushing the cleaned history to GitHub. It encodes the hard-won lessons from real incidents: scan first, backup before rewriting, verify after rewriting, and never force-push to a public repo without checking its visibility and fork count. The bundled scripts automate the mechanical parts: scripts/scanrepo.py — scan the repo for secrets and private context. scripts/rewritehistory.py — create a backup and rewrite history with git-filter-repo. scripts/verifycleanup.py — confirm the sensitive content is gone. scripts/safepush.py — verify repo visibility and push safely. This skill is conservative by design. If any safety check fails, it stops and asks for human confirmation rather than continuing. When to Use This Skill Trigger this skill when the user: Says "scan sensitive data", "扫描敏感信息", "看看仓库有没有泄露". Wants to "clean git history", "sanitize history", "rewrite history", "remove secrets from history". Has accidentally pushed a secret, private domain, internal IP, or PII to a public repository. Is about to force-push to a public repository (even without sensitive data). Mentions git filter-repo, BFG, git-filter-branch, or history rewrite. Prerequisites Install these tools once per machine: The scripts assume git-filter-repo and gitleaks are on PATH. The skill will check this before running destructive operations. Safety Rules (Non-Negotiable) 1. Scan before you decide. Never rewrite history based on a hunch. 2. Create a backup before rewriting. Use git bundle or a fresh bare clone. 3. Verify repo visibility with gh repo view before any push. Do not infer public/private from the URL or directory name. 4. Never use --no-verify to bypass hooks. If the PII Guard hook fails, fix the underlying issue or add an allowlist; do not bypass. 5. Use one explicit lease bound to the saved remote commit. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills daymade/github-sensitive-data-cleanup