skills.rest
organvm-i-theoria
organvm-i-theoriaOFFICIAL
Explore all skills by this author →
GitHub

specstory-guard

Scans .specstory/history files for secrets and blocks commits via a pre-commit hook.

Updated May 16, 2026
Search Tags:#git#security#regex#secret scanning#pre-commit hook#specstory#credential detection
One-click install
npx skills add https://github.com/organvm-i-theoria/_agent-ontology --skill specstory-guard-organvm-i-theoria
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: specstory-guard
Source: https://github.com/organvm-i-theoria/_agent-ontology/tree/main/.agents/skills/specstory-guard
Command: npx skills add https://github.com/organvm-i-theoria/_agent-ontology --skill specstory-guard-organvm-i-theoria

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? AI coding sessions often capture sensitive data like API keys, tokens, and private keys in chat history files. This Skill prevents those secrets from being accidentally committed to your git repository by scanning .specstory/history before every commit. ## Core Features & Use Cases - Pre-Commit Hook Installation: Installs a git pre-commit hook that automatically scans history files on every commit and blocks the commit if secrets are found. - Secret Pattern Detection: Detects AWS keys, GitHub/GitLab/Slack tokens, private keys, JWTs, Stripe keys, and generic credential assignments using regex patterns. - Allowlist Tuning: Supports custom allowlist regex patterns via the SPECSTORY_GUARD_ALLOWLIST environment variable to suppress false positives like placeholders and examples. - Use Case: After pasting an API key into an AI chat to debug an integration, run a manual scan to find the leaked key in your history files, redact it, and rotate the credential before committing. ## Quick Start Ask the AI to install the specstory-guard pre-commit hook and run a scan of your .specstory/history directory for potential secrets.

Frequently Asked Questions about specstory-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan files for secrets before a git commit?▼

Install the pre-commit hook by running the guard script with the install command, which copies a hook into .git/hooks. The hook then automatically scans .specstory/history on every commit and exits with an error if secrets are found.

What secret patterns does a pre-commit secret scanner detect?▼

It detects AWS access keys and secret keys, GitHub, GitLab, and Slack tokens, Google API keys, Stripe live keys, JWTs, private key blocks, and generic credential assignments like password= or api_key= with values of 16 or more characters.

How do I fix false positives in secret scanning?▼

Set the SPECSTORY_GUARD_ALLOWLIST environment variable to a comma-separated list of regex patterns matching known-safe values like placeholders or example keys. Built-in allowlist entries already cover terms like redacted, placeholder, example, and dummy.

Does the secret scanner require external Python packages?▼

No, the scanner uses only the Python standard library including re, os, argparse, and subprocess. It runs with either python3 or python and typically completes in under one second for hundreds of files.

What should I do after secrets are found in chat history files?▼

Redact the secret in the file while preserving surrounding context, re-run the scan to verify, then rotate the affected credential since redaction alone does not revoke access. If the file was already pushed, consider rewriting git history and escalating to your security team.

Related Skills

Explore More Software Engineering Skills→
zapabobzapabob
2

specstory-organize

Organize SpecStory session markdown files into year and month subdirectories.

Community
Basic
aws-samplesaws-samples
12

security-review

Audit AWS infrastructure code for security misconfigurations and remediation guidance.

Official
Intermediate
mattbobambrosemattbobambrose
1

check-secrets

Detect committed secrets and sensitive files in git history and working tree.

Community
Intermediate
balsm-healthbalsm-health
2

implementing-secrets-scanning-in-ci-cd

Automate hardcoded secret detection in CI/CD pipelines with gitleaks and trufflehog.

Official
Advanced