SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillspre-push-security-scan

pre-push-security-scan

Security & auditing

View repository

Updated 10-15 08:02

About this skill

🔒 Pre-Push Security Scan (Iron Rule)

2026-03-04 Lesson: When pushing the AGI-Super-Skills repository, no scan was performed, resulting in 12 real secrets including the Feishu App Secret, Gateway Token, Telegram Bot Token, SSH password, etc. being leaked into the public Git history. Afterwards, git-filter-repo was used to clean up + all were rotated, at an enormous cost.

From now on, before any git push operation, the scanning process of this Skill must be executed. No exceptions.

Trigger Conditions

The following operations must execute a security scan first:

  • git push(any branch)
  • git push --force
  • gh pr create
  • Any operation that synchronizes code to a remote repository
  • cron automatic synchronization tasks

Scanning Process (Three-Layer Check)

Layer 1: Scan the current staging area / the diff to be pushed

# 获取待推送的 commits（与远程对比）
git log --oneline @{u}..HEAD 2>/dev/null || git log --oneline -5

# 扫描 diff 中的敏感模式
git diff @{u}..HEAD 2>/dev/null | grep -inE \
  '(api[_-]?key|secret|token|password|passwd|credential|private[_-]?key|auth)' \
  | grep -v 'REDACTED\|YOUR_.*_HERE\|placeholder\|example\|TODO\|xxx' \
  | head -30

Layer 2: Scan all files in the current working directory

# 高危模式匹配（排除 .git 目录和已知安全占位符）
grep -rnI --include='*.json' --include='*.md' --include='*.yaml' --include='*.yml' \
  --include='*.sh' --include='*.py' --include='*.js' --include='*.ts' --include='*.env' \
  --include='*.toml' --include='*.conf' --include='*.cfg' \
  -E '(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|xoxb-|xoxp-|AIza[a-zA-Z0-9_-]{35}|AKIA[A-Z0-9]{16})' \
  . --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=venv \
  | grep -v 'REDACTED\|YOUR_.*_HERE\|placeholder\|example\|sk-xxx' \
  | head -30

# pass 路径中的密钥值（从 pass store 提取已知密钥进行比对）
# 仅在有 pass 的环境下执行
if command -v pass &>/dev/null; then
  for key_path in api/your-provider api/your-provider api/firecrawl api/deepseek api/your-provider; do
    key_val=$(pass show "$key_path" 2>/dev/null | head -1)
    if [ -n "$key_val" ] && [ ${#key_val} -gt 8 ]; then
      found=$(grep -rnl "$key_val" . --exclude-dir=.git 2>/dev/null)
      if [ -n "$found" ]; then
        echo "🚨 LEAKED: $key_path found in: $found"
      fi
    fi
  done
fi

Layer 3: Scan newly added sensitive content in Git history

# 扫描最近 N 个 commits 的完整 patch
git log -p -10 2>/dev/null | grep -inE \
  '^\+.*(api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]' \
  | grep -v 'REDACTED\|YOUR_.*_HERE\|placeholder\|example' \
  | head -20

Judgment Criteria

Result Action
Layers 1-3 all have 0 matches ✅ Safe, can push
Any layer has a match ❌ Stop push, check item by item
Match is a placeholder/example ✅ Can push after confirmation
Match is a real secret 🚨 Remove immediately, replace with pass show or a placeholder

Remediation Process After Discovering a Leak

# 1. 安装 git-filter-repo
pip install --user --break-system-packages git-filter-repo

# 2. 创建替换文件（每行格式: 真实密钥==>REDACTED_描述）
cat > /tmp/replacements.txt << 'EOF'
actual_secret_value==>REDACTED_SERVICE_NAME
EOF

# 3. 在仓库 clone 中执行替换
git filter-repo --replace-text /tmp/replacements.txt --force

# 4. Force push
git remote add origin <repo-url>
git push --force --all

# 5. 轮换所有已泄露的密钥（最重要！清理历史只防未来，已泄露的必须换）

List of Known Sensitive Patterns (Continuously Updated)

# API Keys
sk-[a-zA-Z0-9]{20,}          # OpenAI/兼容格式
ghp_[a-zA-Z0-9]{36}          # GitHub PAT
ghu_[a-zA-Z0-9]{36}          # GitHub User Token
xoxb-                         # Slack Bot Token
xoxp-                         # Slack User Token
AIza[a-zA-Z0-9_-]{35}        # Google API Key
AKIA[A-Z0-9]{16}             # AWS Access Key

# 飞书
cli_[a-f0-9]{16}             # 飞书 App ID（单独不危险，但不应硬编码）
[a-zA-Z0-9]{32}              # 飞书 App Secret（需结合上下文判断）

# Telegram
[0-9]{8,10}:AA[a-zA-Z0-9_-]{33,35}  # Telegram Bot Token

# Gateway
[a-f0-9]{48}                  # OpenClaw Gateway Token（需结合上下文判断）

# 通用
password\s*[:=]\s*\S+
private_key\s*[:=]
-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----

Automation Integration

Git Hook (Recommended)

In the repository .git/hooks/pre-push add automatic scanning:

#!/bin/bash
# Pre-push hook: security scan
echo "🔒 Running pre-push security scan..."

ISSUES=$(git diff @{u}..HEAD 2>/dev/null | grep -icE \
  '(api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*["\x27]?[a-zA-Z0-9_-]{16,}' \
  2>/dev/null || echo 0)

if [ "$ISSUES" -gt 0 ]; then
  echo "🚨 Found $ISSUES potential secret(s) in push. Aborting."
  echo "Run security scan skill for details."
  exit 1
fi

echo "✅ No secrets detected. Proceeding with push."

Cron Synchronization Tasks

All automatic synchronization cron tasks (such as AGI-Super-Skills synchronization)mustintegrate Layer 1 + Layer 2 scanning before push.

Historical Lessons

Date Event Impact Remediation Cost
2026-02-05 Hardcoded API key in public repository Secret leaked Rotate the secret
2026-03-04 AGI-Super-Skills pushed 12 real secrets Feishu/TG/Gateway/SSH all leaked git-filter-repo + rotate all

Two lessons; a third is not allowed.