Security Check with AI

# Security Check — SoloStack Skill File
> Drop this file into your SoloStack repo and Claude Code will use it as
> context to run this workflow automatically.
---
## Overview
Repo + machine security audit in one command. Scans tracked files + git history for leaked API keys, checks .gitignore coverage, validates frontend bundles aren't leaking server env vars, audits installed Claude skills + MCP servers for supply-chain risk. The skill you run before any push to a public repo.
## Capabilities
1. **Secret scanner (current files)** — Greps every tracked file for known key patterns: Anthropic (sk-ant-…), OpenAI (sk-proj-…), AWS (AKIA…), GitHub (ghp_…), Slack (xoxb-…), JWTs, PEM private keys. CRITICAL on any match.
2. **.gitignore coverage check** — Verifies .env, *.pem, *.key, id_rsa, .aws/, .ssh/, credentials*.json, .mcp.json and other secret/PII paths are gitignored. Tells you exactly which lines to add — and which already-tracked files need `git rm --cached`.
3. **Git history audit** — Searches every branch's full history for ever-committed secret-shaped strings — even if the file was since deleted. Force-pushing a 'fix' doesn't un-leak the secret; rotation does. The skill tells you which keys to rotate at which provider.
4. **Public exposure check** — Reads repo visibility from gh. If public, every CRITICAL finding is amplified. Scans frontend build output (`dist/`) for server-only env vars accidentally bundled to the browser. Optional live-site reachability probe.
5. **Supply chain audit** — Inventories every Claude skill (project + user-level), every MCP server, every global npm/pip install. Flags anything that reads from ~/.ssh/, ~/.aws/, $HOME, or makes network calls to unfamiliar domains. A malicious skill from a tweet can exfiltrate your AWS creds — this is the check that catches it.
6. **Prompt injection guidance** — Always-on reminder: scraped URL content is untrusted input. A malicious page can contain hidden instructions. Static guidance, included in every report — because no scanner can detect this for you.
## Pipeline
## Use Cases
- **Before any `git push` to a public repo:** Run `/security-check`. Critical findings block the push. Non-critical surface as warnings. The skill is designed to be the last step before risky operations.
- **Before flipping a repo private → public:** Once public, every commit in history is grep-able by scraper bots forever. Run this BEFORE the visibility change so you catch leaked secrets while you can still rotate them privately.
- **After installing a new Claude skill or MCP server:** Skills from social media can read .aws/credentials and exfiltrate them. After any install: run `/security-check` to scan supply chain. The skill flags unknowns by name + capability so you can vet them.
- **First deploy to Netlify / Vercel:** Audit D catches the most common first-deploy mistake: a server env var (DATABASE_URL, SERVICE_ROLE) bundled into the frontend because someone used the wrong env-var prefix.
- **Strict mode in CI / pre-push hook:** `/security-check --strict` exits non-zero on any CRITICAL finding. Wire it into a pre-push git hook or a GitHub Actions workflow so security gates the deploy automatically.
## Warnings
## Sample Output
```json
{}
```
Download the complete skill file with full implementation details,
agent prompts, and ready-to-run scripts.