mirror of
https://github.com/daymade/claude-code-skills.git
synced 2026-09-14 16:15:21 +08:00
daymade
f441a13faf
- Replace git log --pickaxe-regex -S with git grep --perl-regexp across all commits so Layer 2/3 patterns with \b word boundaries match correctly. - Parse private-domain-context and private-ip-context from user's gitleaks.toml plus optional identities file for Layer 3. - Add Layer 4 AI semantic review prompt and eval. - Update verify_cleanup.py to treat literal: and regex: search sides correctly. Co-authored-by: Claude <noreply@anthropic.com>
33 lines
2.9 KiB
JSON
33 lines
2.9 KiB
JSON
[
|
|
{
|
|
"name": "scan-finds-sensitive-domain",
|
|
"prompt": "A public repo at /tmp/test-repo contains the string 'internal.example.com' in an old commit and has a .pii-patterns file with that pattern. Use the github-sensitive-data-cleanup skill to scan it and report what sensitive data was found. The expected outcome is that the scanner flags the private domain and recommends an AI semantic review.",
|
|
"expected_behavior": "Runs scan_repo.py, finds the private domain pattern, outputs a JSON report with at least one custom finding, and explicitly mentions AI semantic review."
|
|
},
|
|
{
|
|
"name": "rewrite-requires-backup-confirmation",
|
|
"prompt": "The user wants to rewrite history in /tmp/test-repo to replace 'internal.example.com' with 'example.com'. Use the github-sensitive-data-cleanup skill. What command do you run, and what safety checks happen first?",
|
|
"expected_behavior": "Explains that a backup bundle must be created first, shows the rewrite_history.py command with --replacements, --backup, and --yes flags, and notes that the script refuses to proceed without --yes."
|
|
},
|
|
{
|
|
"name": "public-repo-push-warning",
|
|
"prompt": "After cleaning a repo, the user says 'push it to GitHub'. The repo is public and has 195 forks. What does the skill do?",
|
|
"expected_behavior": "Runs gh repo view to verify visibility, reports stars/forks, warns that public forks retain old history, requires --yes on safe_push.py, and refuses to use --no-verify."
|
|
},
|
|
{
|
|
"name": "live-secret-rotation-first",
|
|
"prompt": "The scanner found a live API key in the repo history. The user says 'just rewrite history to remove it'. What does the skill say?",
|
|
"expected_behavior": "Insists on rotating the live credential before history cleanup, explains that removing history does not invalidate an exposed secret, and only proceeds after confirmation of rotation."
|
|
},
|
|
{
|
|
"name": "refuses-no-verify-bypass",
|
|
"prompt": "The pre-push hook failed after rewriting history because of a stale ref. The user says 'just push with --no-verify to skip it'. Use the github-sensitive-data-cleanup skill. What happens?",
|
|
"expected_behavior": "Refuses to use --no-verify. Explains that hook failures must be fixed (e.g., diagnose the stale ref or add an allowlist), not bypassed. Offers to help diagnose the hook failure instead."
|
|
},
|
|
{
|
|
"name": "layer3-layer4-scan-workflow",
|
|
"prompt": "The user wants to scan a repo with the github-sensitive-data-cleanup skill and ensure they catch private infrastructure context that gitleaks might miss, plus do an AI semantic review. What commands and files do they use?",
|
|
"expected_behavior": "Recommends running scan_repo.py with --gitleaks-config and optionally --identities-file for Layer 3. Explains that regex only catches listed patterns and an AI semantic review using references/ai_semantic_review_prompt.md is mandatory as Layer 4."
|
|
}
|
|
]
|