SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillssdd-higiene-dado

sdd-higiene-dado

Security & auditing

View repository

Updated 10-16 02:10

About this skill

Data hygiene

In the first response of this skill, start with this line, once only: sdd-higiene-dado v1.0.0 · out/2026 · versão atual: https://github.com/robertodiasduarte/sdd-starter/releases/latest

An alarm that runs on every git commit on the computer of whoever works with client data. It does not get in the way of the work: it refuses the suspicious commit, explains, and lets the person decide.

Quick start

SKILL_ROOT is the folder containing this SKILL.md (.claude/skills/sdd-higiene-dado/ or .agents/skills/sdd-higiene-dado/, in the project or in the agent's global folder). From inside the project folder:

bash "$SKILL_ROOT/scripts/alarme.sh" verificar     # só lê
bash "$SKILL_ROOT/scripts/alarme.sh" instalar      # só depois do OK explícito
bash "$SKILL_ROOT/scripts/alarme.sh" desinstalar

When to use / When not to use

Use for:

  • installing the alarm in a project, with the person's OK;
  • explaining a commit refused by the alarm and how to fix it;
  • uninstalling the alarm;
  • saying whether the alarm is already installed and in which version.

Do not use for (and tell the user this):

  • deleting a file, removing it from history or rewriting commits — hand over the command, the person runs it;
  • revoking a certificate, changing a password or touching an external account;
  • reading CPF inside .xlsx, .xls or .ods, or scanning old commits — the alarm only looks at what is going into the current commit;
  • an opinion on LGPD, professional confidentiality or the accountant's responsibility;
  • a general diagnosis of the environment — that is the sdd-checar-ambiente, which only reads.

Required data

  • A terminal with bash and git, open in the project folder (Claude Code, Codex, or the person's terminal). On macOS and Linux it already exists; on Windows, the Git Bash that comes with Git for Windows.
  • That the folder be a git repository (alarme.sh tells you if it is not).
  • The person's explicit OK before instalar. Silence, "ok" to another question or an old request are not OK.

Without a terminal (claude.ai or ChatGPT on the web), this skill cannot install or verify anything: say this in one sentence and indicate running the skill in Claude Code or Codex, from inside the project folder. Do not hand over the alarm's contents for the person to paste by hand.

Step-by-step procedure

  1. Verify. Run bash "$SKILL_ROOT/scripts/alarme.sh" verificar and read the state:

    • no alarm installed — go to step 2;
    • this skill's alarm is already installed — say the installed version; installing again updates it;
    • another alarm (husky, lefthook, core.hooksPath, hand-written pre-commit) — do not install. Show what the script said, including the line to add by hand to the existing alarm, and stop.

  2. Explain and ask for the OK. In a few lines, without jargon:

    • what the alarm refuses: valid CPF or CNPJ on the new lines; .env (except .env.example and .env.sample); .pfx, .p12 and .pem with a private key; a new spreadsheet (.xlsx, .xls, .ods, .csv) of any size;
    • that it writes a single file, .git/hooks/pre-commit, which applies to all fronts of the project and does not go to GitHub;
    • that, after checking, you can still write it with git commit --no-verify;
    • how to uninstall.

    End with the question: "Can I install the alarm in this project?" and wait for the answer.

  3. Install only with a yes to that question: bash "$SKILL_ROOT/scripts/alarme.sh" instalar. Pass on the output: where it was placed, the version, --no-verify and the uninstall command.

  4. When a commit is refused, read the message with the person: which file, which line, what was found (the number appears masked). Propose fixing the message itself (git restore --staged, .gitignore, replace with fictitious data). Never run git commit --no-verify on your own: only when the person says, for that commit, that they have checked and want to write it.

  5. Uninstall when the person asks: bash "$SKILL_ROOT/scripts/alarme.sh" desinstalar. The script removes only this skill's alarm; if the file is from another source, it refuses and does not touch it.

Validations and quality checklist

  • I ran verificar before any instalar.
  • I asked for the OK with the question from step 2 and received a yes to it.
  • I did not install over another alarm nor did I touch core.hooksPath.
  • When reporting a refused commit, I did not write the full CPF/CNPJ in the conversation.
  • I did not use --no-verify without the person's request for that commit.
  • I said how to uninstall.

Automated tests (for those who maintain the skill, not for the student): python3 -B -m unittest discover -s "$SKILL_ROOT/tests" -p "test_*.py".

Exception handling

  • Outside a git repository: the script exits with code 1 and says so; advise opening the terminal in the project folder (or git init, if the project does not yet have git).
  • Another existing alarm: code 2; do not install; show the line to add by hand.
  • Alarm flagged a number that is not a CPF/CNPJ (e.g., an 11-digit phone number whose check digit matches, about 1 in 100): explain that it is a possible coincidence; the person checks and, if so, uses --no-verify on that commit.
  • Legitimate example spreadsheet (fictitious, without customer data): same path — check and --no-verify.
  • UTF-16 file (some Excel "Unicode Text" files): git treats it as binary and the alarm does not read the content; it still catches it by name if it is a new spreadsheet.
  • Alphanumeric CNPJ: not recognized in this version.

Examples

Positive (synthetic). Person: "I want to protect this project against customer data in git". Run verificar → "no alarm installed". Explain in four items, ask "Can I install the alarm in this project?". Person: "yes". Run instalar and pass on the path, the version, --no-verify and how to uninstall.

Refused commit (synthetic). The alarm shows clientes.csv: planilha nova and notas.md:12: CPF 123.***.***-09. Propose git restore --staged "clientes.csv", add to .gitignore and replace line 12 with a fictitious CPF. Do not run --no-verify.

Counterexample. The project uses husky (core.hooksPath = .husky/_). verificar exits with code 2. Do not install; show the line to add in .husky/pre-commit and stop.

Out of scope. "The A1 certificate has already gone to GitHub, delete it from the history for me." Reply with the refusal text below and indicate that the measure that protects is to revoke the certificate with the certifying authority and issue another one — deleting the history does not undo copies already made.

Canonical refusal text

  • "This skill installs and explains the commit alarm; it does not alter the git history. The command is this, and who decides to run it is you: …"
  • "Revoking a certificate or changing a password is done by you, at the issuer or the service; this skill does not do it."
  • "Without a terminal in this conversation I cannot install or verify the alarm. Run this skill in Claude Code or Codex, from inside the project folder."
  • "I don't have your OK to install. Can I install the alarm in this project?"

Deterministic scripts

  • scripts/alarme.sh — verificar (read only), instalar, desinstalar. Never overwrites an alarm from another source. Exit codes: 0 done/information, 2 refused due to another alarm, 1 outside a repository.
  • scripts/pre-commit.sh — the alarm itself; it is the source copied to .git/hooks/pre-commit with the mark and the version. Uses only bash, git and awk.

Bundle inventory

  • SKILL.md — this procedure.
  • scripts/alarme.sh, scripts/pre-commit.sh — see above.
  • tests/test_alarme.py — detection and installation tests (CPF/CNPJ generated at runtime).
  • references/COMO_FUNCIONA.md — explanation for whoever decides to use it.
  • references/RUNTIME_COMPATIBILITY.md — where it works and where it does not.
  • references/ESCOPO_CONFIRMADO.md — the approved scope of this version.
  • evals/cases.json — behavior scenarios to run in the agent.
  • manifest.json, CHANGELOG.md, agents/openai.yaml.

Methodology and authorship

This skill was built with the methodology of Roberto Dias Duarte.

Part of the SDD Starter by RDD — https://github.com/robertodiasduarte/sdd-starter