Omar SobhandClaude Opus 4.7
7b23f61632
Hand-authored skill catalog anchored to real 2026-07 versions:
- Rust 1.97.1 (stable), edition 2024
- React 19.2.7, Server Components + Actions
- TailwindCSS 4.3.3 (CSS-first config, Oxide engine)
- three.js r185 (WebGPURenderer stable, BatchedMesh matured)
- React Native 0.86 / Expo SDK 54+ (New Architecture default)
- cargo-nextest 0.9.140, gitleaks 8.20+, cargo-audit 0.21+
- Postgres 17 (18 in beta, don't rely on)
- CUDA Blackwell, Metal Apple7+, ROCm CDNA3
Ships 15 skills across the categories:
foundation/ workspace-repo-commit-protocol
small-focused-commits
tdd-red-green-refactor
code-review-checklist
int-xx-marker-protocol
decompose-int-items
rust/ write-rust-current-edition
rust-error-handling
cargo-test-driven-development
rust-async-tokio-idioms
backend/ postgres-migrations-forward-only
postgres-index-selection
api-pagination-day-1
frontend/ react-19-server-components
tailwind-v4-idioms
component-4-state-model
mobile/ expo-managed-vs-bare
rn-flashlist-perf
gpu/ gpu-coalescing-and-occupancy
roofline-model
threejs/ threejs-perf-and-teardown
security/ cargo-audit-workflow
secret-scanning-gitleaks
skills_loader.rs walks skills/**/*.md, parses YAML frontmatter
(name, description, when_to_use, tags), upserts via
skills_catalog::upsert_builtin. Idempotent per boot — bumps version
+ appends skill_versions row ONLY when body changes. Deterministic
sha256-derived ids so builtins are stable across boots.
Dockerfile copies skills/ to /etc/clawmates/skills. Server boot
task spawns loader alongside team_template_loader.
Follow-ups (Slice 3.5c continuation, future PRs):
- 20-30 more skills (duckdb, shadcn composition, a11y, WebGPU
migration, metal frame capture, rocprof, deep gitea forge
integration, semgrep rulepacks)
- Bind skills to team template roles (add [role.skills] refs to
templates/teams/*.toml + wire template_role_skills population
in team_template_loader)
Co-Authored-By: Claude Opus 4.7 <[email protected]>
84 lines
3.3 KiB
Markdown
84 lines
3.3 KiB
Markdown
---
|
|
name: secret-scanning-gitleaks
|
|
description: Detecting + removing leaked credentials with gitleaks 8+. Pre-commit + CI + full history sweep policies.
|
|
when_to_use: You're on a security mission, or setting up a new repo, or triaging a "did we push a key?" incident.
|
|
tags: [security, git]
|
|
---
|
|
|
|
# Gitleaks workflow
|
|
|
|
Anchored to **gitleaks 8.20+** (2026 line). Detects secrets in the working tree, staged changes, and git history.
|
|
|
|
## Modes
|
|
|
|
- **`gitleaks protect --staged`** — pre-commit hook. Blocks commits containing secrets.
|
|
- **`gitleaks detect`** — scans working tree + full history. Use in CI.
|
|
- **`gitleaks detect --log-opts="--since=2026-01-01"`** — bounded historical sweep for large repos.
|
|
|
|
## Pre-commit integration
|
|
|
|
```bash
|
|
# .pre-commit-config.yaml
|
|
repos:
|
|
- repo: https://github.com/gitleaks/gitleaks
|
|
rev: v8.20.0
|
|
hooks:
|
|
- id: gitleaks
|
|
```
|
|
|
|
## Config: `.gitleaks.toml`
|
|
|
|
```toml
|
|
title = "clawmates gitleaks config"
|
|
[extend]
|
|
useDefault = true # start from bundled rules
|
|
|
|
[[rules]]
|
|
id = "clawmates-internal-token"
|
|
description = "Our internal service session token pattern"
|
|
regex = '''cm_svc_[a-f0-9]{64}'''
|
|
tags = ["clawmates", "token"]
|
|
|
|
[allowlist]
|
|
description = "Test fixtures that intentionally contain fake secrets"
|
|
paths = ['''crates/cm-auth/tests/fixtures/.*''']
|
|
regexes = ['''sk-ant-api03-TEST[a-zA-Z0-9]+''']
|
|
```
|
|
|
|
Rules to add per-repo, not global — every codebase has domain-specific token shapes.
|
|
|
|
## What to do when it fires
|
|
|
|
**On a commit-in-progress:**
|
|
1. Don't commit.
|
|
2. Rotate the credential immediately (whether you'd have pushed it or not — assume compromised the moment it existed on disk).
|
|
3. Remove from the file. Re-attempt.
|
|
|
|
**On a historical hit (already pushed):**
|
|
1. Rotate first, panic second.
|
|
2. Force-remove from history with `git filter-repo --replace-text` or `bfg-repo-cleaner`.
|
|
3. `git push --force` after coordination with everyone with a clone (they'll need to `git reset --hard origin/main` to avoid re-introducing).
|
|
4. Notify anyone who might have cached the value (CI logs, artifact registries, error monitoring backends often store request bodies).
|
|
|
|
## What gitleaks misses
|
|
|
|
- **Base64-encoded secrets.** Add a rule if you use them.
|
|
- **Split-across-lines secrets** — most rules are single-line regex.
|
|
- **Secrets in binary files.** Gitleaks skips binaries by default; scan artifacts separately.
|
|
- **Encrypted-at-rest formats** (age, sops) — encrypted content is opaque to gitleaks; make sure the ENCRYPTED file being in the repo is the intent.
|
|
|
|
## Integration with the security mission template
|
|
|
|
Runs `gitleaks detect --report-format=json` in the security_scan phase. Each finding becomes a `mission_task`:
|
|
- `external_id = <fingerprint>`
|
|
- `title = "<RuleID> at <file>:<line>"`
|
|
- `status = "created"`
|
|
|
|
The coding phase remediates: rotate + purge + add allowlist entry if a false positive. Emit `COMPLETED: <fingerprint>` when the rotation is confirmed AND the historical removal is deployed.
|
|
|
|
## Anti-patterns
|
|
|
|
- **Adding a blanket `.gitleaks.toml` allowlist** covering entire directories. Neuters detection. Allowlist specific patterns with justification comments.
|
|
- **Fixing the secret leak by squashing history without rotating.** The secret was on disk on multiple machines; it's compromised. Rotate first.
|
|
- **`.gitignore` as your secret defense.** Files can be added by name from the CLI; gitignore only helps `git add .` sweeps.
|