github-sensitive-data-cleanup

1# GitHub Sensitive Data Cleanup
2 
3## Overview
4 
5This skill guides you through safely removing sensitive data from a Git
6repository's history and pushing the cleaned history to GitHub. It encodes the
7hard-won lessons from real incidents: scan first, backup before rewriting,
8verify after rewriting, and never force-push to a public repo without checking
9its visibility and fork count.
10 
11The bundled scripts automate the mechanical parts:
12 
13- `scripts/scan_repo.py` — scan the repo for secrets and private context.
14- `scripts/rewrite_history.py` — create a backup and rewrite history with
15  `git-filter-repo`.
16- `scripts/verify_cleanup.py` — confirm the sensitive content is gone.
17- `scripts/safe_push.py` — verify repo visibility and push safely.
18 
19**This skill is conservative by design.** If any safety check fails, it stops
20and asks for human confirmation rather than continuing.
21 
22## When to Use This Skill
23 
24Trigger this skill when the user:
25 
26- Says "scan sensitive data", "扫描敏感信息", "看看仓库有没有泄露".
27- Wants to "clean git history", "sanitize history", "rewrite history",
28  "remove secrets from history".
29- Has accidentally pushed a secret, private domain, internal IP, or PII to a
30  public repository.
31- Is about to force-push to a public repository (even without sensitive data).
32- Mentions `git filter-repo`, `BFG`, `git-filter-branch`, or history rewrite.
33 
34## Prerequisites
35 
36Install these tools once per machine:
37 
38```bash
39# git-filter-repo (modern replacement for git-filter-branch)
40…