vibe-sanitizer#

Use this skill to scan a Git repository for secrets, credentials, or machine-specific file paths and make a repository safer before commit, before sharing, or before publishing.

This skill is for local agent workflows in Codex, Claude Code, OpenClaw, and similar coding agents that can read repositories and run shell commands.

When To Use#

Use this skill when the user wants to...Recommended actionScan a repo before commitscan --scope working-tree or scan --scope stagedAudit tracked files or a commitscan --scope tracked or scan --scope commitFix safe findings in the original reposanitize --mode in-placeCreate a shareable sanitized copyexport --output ...Check AI-assisted or vibe-coded repos for leaked pathsUse normal scan flow with path detectors enabled

What It Catches#

CategoryDetectorsPrivate materialPEM-style private key blocksAPI keys and tokensOpenAI-style keys, AWS access key ids, GitHub tokens, Slack tokens, bearer tokensCredentials in textURLs with embedded credentials, quoted secret-like assignmentsMachine-specific pathsWorkspace paths, home-directory paths, temporary paths, Windows user-directory pathsFinding classMeaningFixableSafe to rewrite in placeReview-requiredShould be flagged, but not auto-rewritten in the original repo

Runtime Setup#

StepCommandVerify bundled CLIcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli --helpIf not in audited repoPass --root {{repo_dir}}If verification failsConfirm {{skill_dir}}/src/vibe_sanitizer/cli.py exists and python3 is available

Workflow#

StepAction1Confirm the target repository root2Run the bundled CLI from {{skill_dir}}/src3Use the narrowest useful scope4Run scan first5Summarize findings by file, detector, severity, and fixability6Never print raw secret values7Use sanitize --mode in-place only for safe pre-commit cleanup8Use export when the user wants a separate sanitized copy

Scope Guide#

ScopeUse whenworking-treeChecking tracked and untracked files that are not ignoredstagedChecking what is about to be committedtrackedAuditing tracked repository filescommitAuditing one specific commit

Commands#

TaskCommandVerify CLIcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli --helpWorking tree scancd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli scan --root {{repo_dir}} --scope working-treeStaged scancd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli scan --root {{repo_dir}} --scope stagedTracked auditcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli scan --root {{repo_dir}} --scope tracked --format jsonCommit auditcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli scan --root {{repo_dir}} --scope commit --commit <sha>Safe in-place cleanupcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli sanitize --root {{repo_dir}} --scope staged --mode in-placeShareable exportcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli export --root {{repo_dir}} --scope tracked --output ../safe-shareStarter configcd {{skill_dir}}/src && python3 -m vibe_sanitizer.cli init-config --path {{repo_dir}}/.vibe-sanitizer.yml

Guardrails#

RuleRequirementSecret handlingNever paste full secrets or full local paths into the responseReportingPrefer masked snippets such as sk-***abcdScopePrefer the narrowest scope that answers the requestIn-place rewriteDo not auto-rewrite review-required findings unless explicitly requestedExportDo not export into a directory inside the source repositoryRepo modelDo not treat an exported copy as the default replacement for the main repoRuntime assumptionDo not assume a global vibe_sanitizer install when bundled source exists

Agent Response Style#

IncludeAvoidScope usedRaw credentialsCounts by severity when usefulFull local machine pathsGrouping by file when usefulUnnecessary command noiseWhich findings are fixableImplying review-required findings were auto-fixedWhich findings need manual review

Supported CLI Commands#

CommandPurposescanReport findingssanitizeRewrite only safe findings in placeexportCreate a separate sanitized copyinit-configCreate a starter config file