Pre-push hygiene check for GitHub repositories. Scans for PII, secrets, and sensitive data before pushing. Audits commit messages, enforces repo-specific blocklists, and rate-limits pushes to avoid GitHub abuse detection. Use before any git push, especially to public repos.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Pre-push hygiene check for GitHub repositories. Scans for PII, secrets, and sensitive data before pushing. Audits commit messages, enforces repo-specific blocklists, and rate-limits pushes to avoid GitHub abuse detection. Use before any git push, especially to public repos.
The template includes commented-out examples for client names, hostnames, IP ranges, tracking IDs, and Slack token shapes. Replace them with values specific to your environment.
If the file is missing, the skill runs with a warning instead of erroring — but personal pattern checks are skipped, so creating it is strongly recommended.
Procedure
1. Classify the repo
# Check if public repo
git remote -v
# Check for .public-repo markertest -f .public-repo && echo"PUBLIC" || echo"private or unmarked"
If public (or pushing to a public remote): apply ALL checks below.
If private: apply only the PII scan (step 2).
2. PII and secrets scan
Load your personal pattern list from ~/.claude/safe-push-blocklist and scan against it. The same patterns apply to diff content (step 2) AND commit messages (step 3) — both run from the same source of truth.
Default mode — scan the diff against the target branch:
# Load personal patterns (graceful fallback if file missing):if [ -f ~/.claude/safe-push-blocklist ]; then
PATTERNS=$(grep -v '^#' ~/.claude/safe-push-blocklist | grep -v '^$' | paste -sd '|' -)
else
PATTERNS=""echo"WARNING: ~/.claude/safe-push-blocklist not found. Personal pattern checks skipped."fi
git diff origin/main...HEAD
[ -n "$PATTERNS" ] && git diff origin/main...HEAD | grep -nE "$PATTERNS" \
|| echo"NO MATCHES IN DIFF"
Full repo mode (/safe-push --full) — scan ALL tracked files, not just the diff. Use this for baseline audits, first-time pushes of existing repos, or periodic hygiene checks:
Edit ~/.claude/safe-push-blocklist to maintain your personal patterns. Never hardcode real client names or infrastructure identifiers inside this skill file — the blocklist is the source of truth.
If anything is found:
List each finding with file, line number, and what was detected
Ask the user to fix before proceeding
Do NOT push until resolved
3. Commit message audit
Review the FULL commit message — both subject (title) and body (description) — for every commit in the push range. Sensitive patterns can hide in either:
# Print the full message (subject + body) for every commit:
git log origin/main..HEAD --format="===%h %s===%n%b"# Programmatically scan the full message text against the same# blocklist used for diff content (graceful fallback if file missing):if [ -f ~/.claude/safe-push-blocklist ]; then
PATTERNS=$(grep -v '^#' ~/.claude/safe-push-blocklist | grep -v '^$' | paste -sd '|' -)
git log origin/main..HEAD --format="%B" | grep -nE "$PATTERNS" \
|| echo"NO MATCHES IN MESSAGES"elseecho"WARNING: ~/.claude/safe-push-blocklist not found. Personal pattern checks skipped on commit messages."fi
The same patterns from ~/.claude/safe-push-blocklist that block diff content (step 2) ALSO block commit messages. Apply the full blocklist to BOTH title and body — not just the diff. For public repos, also flag:
Personal info (email, phone, address) — categorical, not always pattern-matched
Private repo names you own (e.g., upstream dev mirrors) — soft-warn, ask user before pushing
~/.claude/safe-push-blocklist — Your personal pattern blocklist. One regex per line; comments start with #. Loaded on every /safe-push invocation. Edit this file to add or remove patterns; never hardcode patterns in this skill file. See Install above for setup.
Repo-local .pii-allowlist — One regex per line, matches are excluded from PII scan (used to allow false positives like example keys in docs).
Repo-local .commit-msg-blocklist — Terms that should never appear in public commit messages for this specific repo.
Notes
This skill does NOT bypass the global pre-commit hook — they work together
For projects with a public/private repo split (dev mirror → public release): always push to the dev repo first, sync via your sync script, then safe-push the public repo
