Git Repository Auditor

What This Does

A CLI tool to audit Git repositories for security issues, code quality problems, and repository health. Scan repositories for secrets, large files, sensitive data, and common security anti-patterns.

Key features:

• - Secrets detection: Scan Git history for API keys, passwords, tokens, and other sensitive data using regex patterns
• Large file detection: Identify large files (>10MB) in repository history that may impact performance
• Security anti-patterns: Detect hardcoded credentials, insecure configuration files, and dangerous permissions
• Repository health: Check for merge conflicts, stale branches, and other repository hygiene issues
• Compliance reporting: Generate security compliance reports for audits and team reviews
• Multiple output formats: Human-readable, JSON, and CSV output for integration with other tools
• Custom scanning: Configure custom regex patterns and file extensions to scan
• Historical analysis: Scan entire Git history or specific time ranges
• Remediation guidance: Suggest fixes for identified security issues

When To Use

• - You need to audit a Git repository for security compliance
• You want to detect accidental commits of secrets or sensitive data
• You're preparing a repository for open-source release
• You need to identify performance issues (large files in history)
• You're onboarding new developers and want to ensure repository hygiene
• You need to generate security audit reports for compliance requirements
• You want to automate security scanning in CI/CD pipelines
• You're cleaning up old repositories and need to identify issues

Usage

Basic commands:

CODEBLOCK0

Examples

Example 1: Basic security scan

CODEBLOCK1

Output:
CODEBLOCK2

Example 2: JSON output for CI/CD integration

CODEBLOCK3

Output (excerpt):
CODEBLOCK4

Example 3: Check repository health

CODEBLOCK5

Output:
CODEBLOCK6

Example 4: Large files detection only

CODEBLOCK7

Output:
CODEBLOCK8

Requirements

• - Git 2.20+ installed and available in PATH
• Python 3.x
• No external Python dependencies required (uses standard library)

Limitations

• - Scanning large repositories with extensive history may be slow
• Secrets detection uses regex patterns; may have false positives/negatives
• Does not automatically remove secrets from history (requires manual remediation)
• Limited to Git repositories (does not work with other VCS)
• No support for scanning encrypted repositories
• Large file detection scans entire history; may miss files in ignored directories
• Does not integrate with external secret managers (Vault, AWS Secrets Manager, etc.)
• No real-time monitoring; scans only historical commits
• Limited to text file scanning; cannot detect secrets in binary files
• May not detect all secret patterns; custom patterns may be needed
• Performance depends on repository size and history depth
• No support for scanning Git submodules automatically
• No built-in integration with secret management systems (Vault, AWS Secrets Manager)
• Limited to text file scanning; cannot detect secrets in binary files
• No support for custom Git hooks or pre-commit integration
• Performance may be impacted on repositories with millions of commits
• No support for distributed scanning across multiple repositories
• Limited error handling for corrupted Git repositories
• No support for scanning Git worktrees or shallow clones
• Cannot scan remote repositories without local clone
• No built-in notification system for new issues

Directory Structure

The tool works with any local Git repository. No special configuration directories are required, but you can provide custom patterns files for secrets detection.

Error Handling

• - Invalid repository paths show helpful error messages with suggestions
• Git command failures show the underlying error and suggest troubleshooting steps
• Permission errors suggest checking repository access rights
• Pattern file parsing errors show line numbers and validation issues
• Memory errors suggest using smaller commit ranges or more specific scanning

Contributing

This is a skill built by the Skill Factory. Issues and improvements should be reported through the OpenClaw project.