npx skills add https://github.com/alfredang/skills --skill 'GitHub Push'/github-push 或 github-push
Git 与安全
github push, git push, secret detection, api key scan, credential scan, security check, push to github, commit and push, secret scanner, readme generator, safe push, secure push, pre-push hook, leak detection, api key exposed, password exposed
通过自动扫描暴露的密钥、API 密钥和凭据,安全地将代码推送到 GitHub。如果缺失,则自动生成 README.md,配置仓库描述、实时站点 URL、主题,并启用 GitHub Discussions。
此技能使用 Claude Code 订阅计划 运行。请勿使用按量付费的 API 密钥。所有 AI 操作都应在具有活跃订阅的 Claude Code CLI 环境中执行。
我将帮助您安全地推送到 GitHub!
工作流程包括:
| 步骤 | 描述 |
|---|---|
| 密钥扫描 | 检测暴露的 API 密钥、密码和凭据 |
| 文件审查 | 检查不应提交的敏感文件 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| README 生成 | 如果缺失,通过 /create_github_readme 技能自动生成 README.md |
| Git 提交 | 暂存并提交,附带 AI 生成的提交信息 |
| 推送 | 推送到远程仓库 |
| PR 创建 | 可选地创建拉取请求 |
| 仓库信息 | 自动调用 /github-about 来设置描述、实时站点 URL 和主题 |
执行 /github_push 时,请遵循此工作流程:
在进行任何 Git 操作之前,扫描代码库以查找暴露的密钥。这是一个阻塞性要求——如果发现密钥,则不得继续。
git diff --cached --name-only
扫描所有暂存文件以查找以下模式:
AWS 凭据
AKIA[0-9A-Z]{16}
aws_access_key_id\s*=\s*['"][A-Za-z0-9/+=]+['"]
aws_secret_access_key\s*=\s*['"][A-Za-z0-9/+=]+['"]
API 密钥(通用)
api[_-]?key\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
apikey\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
api[_-]?secret\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
私钥
-----BEGIN (RSA|DSA|EC|OPENSSH|PGP) PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
数据库连接字符串
postgres(ql)?://[^\s'"]+
mysql://[^\s'"]+
mongodb(\+srv)?://[^\s'"]+
redis://[^\s'"]+
OAuth 和 Bearer 令牌
bearer\s+[A-Za-z0-9\-_.~+/]+=*
oauth[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
access[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
refresh[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
云服务商密钥
# Google Cloud
AIza[0-9A-Za-z\-_]{35}
# Azure
[a-zA-Z0-9+/]{86}==
# Heroku
[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}
# Stripe
sk_live_[0-9a-zA-Z]{24}
rk_live_[0-9a-zA-Z]{24}
pk_live_[0-9a-zA-Z]{24}
# Twilio
SK[0-9a-fA-F]{32}
# SendGrid
SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}
# Slack
xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*
# GitHub
gh[pousr]_[A-Za-z0-9_]{36,}
# OpenAI
sk-[A-Za-z0-9]{48}
# Anthropic
sk-ant-[A-Za-z0-9\-_]{90,}
通用密钥
password\s*[:=]\s*['"][^'"]{8,}['"]
secret\s*[:=]\s*['"][^'"]{8,}['"]
credential\s*[:=]\s*['"][^'"]{8,}['"]
private[_-]?key\s*[:=]\s*['"][^'"]+['"]
JWT 令牌
eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*
永远不应提交的文件:
.env, .env.*(环境文件)*.pem, *.key, *.p12, *.pfx(证书/密钥)credentials.json, secrets.json, config.secret.*id_rsa, id_dsa, id_ecdsa, id_ed25519(SSH 密钥)*.keystore, *.jks(Java 密钥库).htpasswd, .netrc, .npmrc(认证文件)wp-config.php(WordPress 配置)database.ymlsettings.py重要提示:切勿在配置文件中存储密钥!
密钥绝不应硬编码在以下配置文件中:
config.json, config.yaml, config.tomlsettings.json, settings.py, settings.jsapp.config.js, next.config.js, vite.config.ts应存储密钥的位置:
.env 文件(必须在 .gitignore 中)uv 密钥文件(uv 支持加载 .env)验证 .gitignore 包含:
grep -E "^\.env|^\.env\.|\.pem$|\.key$|credentials|secrets" .gitignore
如果发现密钥:
.env 文件(确保 .env 在 .gitignore 中).env 配合 uv run,它会自动加载环境变量process.env.SECRET_NAME(Node.js)或 os.environ["SECRET_NAME"](Python)发现密钥时的示例输出:
SECURITY ALERT: Secrets detected in staged files!
File: src/config.js:15
Type: API Key
Pattern: api_key = "sk-abc123..."
File: .env:3
Type: Database URL
Pattern: DATABASE_URL=postgres://user:password@...
BLOCKED: Cannot push until secrets are removed.
Remediation:
1. Remove secrets from config files (NEVER store secrets in config files!)
2. Move secrets to .env file (ensure .env is in .gitignore)
3. For Python/uv: use .env file - uv run auto-loads environment variables
4. Access via: process.env.API_KEY (Node.js) or os.environ["API_KEY"] (Python)
5. Run: git reset HEAD <file> to unstage
如果未发现密钥:
Security scan complete: No secrets detected.
Proceeding with push...
检查项目根目录是否存在 README.md:
ls README.md 2>/dev/null
如果不存在 README.md:
/create_github_readme 技能以生成专业的 READMEREADME.md(以及 screenshot.png,如果已创建)如果已存在 README.md:
git status
git diff --cached --stat
如果需要暂存文件:
git add <specific-files>
重要提示: 切勿使用 git add -A 或 git add . - 始终添加特定文件,以避免意外提交敏感文件。
根据变更内容:
feat: 新功能fix: 错误修复docs: 文档refactor: 代码重构test: 测试chore: 维护git commit -m "$(cat <<'EOF'
<type>: <description>
<optional body>
Co-Authored-By: Claude <noreply@anthropic.com>
EOF
)"
git push origin <branch>
如果推送因上游变更而失败:
git pull --rebase origin <branch>
git push origin <branch>
如果用户请求创建 PR:
gh pr create --title "<title>" --body "$(cat <<'EOF'
## Summary
- Change 1
- Change 2
## Test Plan
- [ ] Test 1
- [ ] Test 2
---
Generated with [Claude Code](https://claude.ai/code)
EOF
)"
/github-about)推送后,自动运行 /github-about 技能以更新仓库的“关于”部分。
/github-about 技能将:
只需调用 /github-about - 它会自动处理身份验证、检测和更新。
/github-about 完成后,如果尚未启用,也启用 discussions:
gh repo view --json hasDiscussionsEnabled
如果未启用 discussions:
gh repo edit --enable-discussions
/create_github_readme 技能自动生成专业的 README.md/github-about 来设置仓库描述、实时站点 URL 和主题| 类别 | 示例 |
|---|---|
| 云凭据 | AWS、GCP、Azure、Heroku |
| API 密钥 | OpenAI、Anthropic、Stripe、Twilio、SendGrid |
| 认证令牌 | OAuth、Bearer、JWT、会话令牌 |
| 数据库 URL | PostgreSQL、MySQL、MongoDB、Redis |
| 私钥 | RSA、DSA、EC、SSH、PGP |
| 平台令牌 | GitHub、Slack、Discord webhooks |
| 通用密钥 | 密码、凭据、代码中的密钥 |
运行 /github_push 后:
每周安装次数
0
仓库
GitHub 星标数
1
首次出现时间
1970年1月1日
安全审计
/github-push or github-push
Git & Security
github push, git push, secret detection, api key scan, credential scan, security check, push to github, commit and push, secret scanner, readme generator, safe push, secure push, pre-push hook, leak detection, api key exposed, password exposed
Securely push code to GitHub by automatically scanning for exposed secrets, API keys, and credentials. Auto-generates README.md if missing, configures repo description, live site URL, topics, and enables GitHub Discussions.
This skill runs using Claude Code with subscription plan. Do NOT use pay-as-you-go API keys. All AI operations should be executed through the Claude Code CLI environment with an active subscription.
I'll help you securely push to GitHub!
The workflow includes:
| Step | Description |
|---|---|
| Secret Scan | Detect exposed API keys, passwords, and credentials |
| File Review | Check for sensitive files that shouldn't be committed |
| README Gen | Auto-generate README.md via /create_github_readme skill if missing |
| Git Commit | Stage and commit with AI-generated message |
| Push | Push to remote repository |
| PR Create | Optionally create a pull request |
| Repo About | Auto-invoke /github-about to set description, live site URL, and topics |
When executing /github_push, follow this workflow:
Before ANY git operations, scan the codebase for exposed secrets. This is a blocking requirement - do not proceed if secrets are found.
git diff --cached --name-only
Scan ALL staged files for these patterns:
AWS Credentials
AKIA[0-9A-Z]{16}
aws_access_key_id\s*=\s*['"][A-Za-z0-9/+=]+['"]
aws_secret_access_key\s*=\s*['"][A-Za-z0-9/+=]+['"]
API Keys (Generic)
api[_-]?key\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
apikey\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
api[_-]?secret\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]
Private Keys
-----BEGIN (RSA|DSA|EC|OPENSSH|PGP) PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
Database Connection Strings
postgres(ql)?://[^\s'"]+
mysql://[^\s'"]+
mongodb(\+srv)?://[^\s'"]+
redis://[^\s'"]+
OAuth & Bearer Tokens
bearer\s+[A-Za-z0-9\-_.~+/]+=*
oauth[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
access[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
refresh[_-]?token\s*[:=]\s*['"][A-Za-z0-9_\-]+['"]
Cloud Provider Secrets
# Google Cloud
AIza[0-9A-Za-z\-_]{35}
# Azure
[a-zA-Z0-9+/]{86}==
# Heroku
[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}
# Stripe
sk_live_[0-9a-zA-Z]{24}
rk_live_[0-9a-zA-Z]{24}
pk_live_[0-9a-zA-Z]{24}
# Twilio
SK[0-9a-fA-F]{32}
# SendGrid
SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}
# Slack
xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*
# GitHub
gh[pousr]_[A-Za-z0-9_]{36,}
# OpenAI
sk-[A-Za-z0-9]{48}
# Anthropic
sk-ant-[A-Za-z0-9\-_]{90,}
Generic Secrets
password\s*[:=]\s*['"][^'"]{8,}['"]
secret\s*[:=]\s*['"][^'"]{8,}['"]
credential\s*[:=]\s*['"][^'"]{8,}['"]
private[_-]?key\s*[:=]\s*['"][^'"]+['"]
JWT Tokens
eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*
Files that should NEVER be committed:
.env, .env.* (environment files)*.pem, *.key, *.p12, *.pfx (certificates/keys)credentials.json, secrets.json, config.secret.*id_rsa, id_dsa, , (SSH keys)IMPORTANT: Never store secrets in config files!
Secrets should NEVER be hardcoded in configuration files like:
config.json, config.yaml, config.tomlsettings.json, settings.py, settings.jsapp.config.js, next.config.js, vite.config.tsWhere to store secrets instead:
.env files (must be in .gitignore)uv secret files for Python projects (uv supports .env loading)Verify .gitignore includes:
grep -E "^\.env|^\.env\.|\.pem$|\.key$|credentials|secrets" .gitignore
If secrets are found:
.env file (ensure .env is in .gitignore).env with uv run which auto-loads environment variablesprocess.env.SECRET_NAME (Node.js) or os.environ["SECRET_NAME"] (Python)Example output when secrets found:
SECURITY ALERT: Secrets detected in staged files!
File: src/config.js:15
Type: API Key
Pattern: api_key = "sk-abc123..."
File: .env:3
Type: Database URL
Pattern: DATABASE_URL=postgres://user:password@...
BLOCKED: Cannot push until secrets are removed.
Remediation:
1. Remove secrets from config files (NEVER store secrets in config files!)
2. Move secrets to .env file (ensure .env is in .gitignore)
3. For Python/uv: use .env file - uv run auto-loads environment variables
4. Access via: process.env.API_KEY (Node.js) or os.environ["API_KEY"] (Python)
5. Run: git reset HEAD <file> to unstage
If NO secrets found:
Security scan complete: No secrets detected.
Proceeding with push...
Check if a README.md exists in the project root:
ls README.md 2>/dev/null
If no README.md exists:
/create_github_readme skill to generate a professional READMEREADME.md (and screenshot.png if created)If README.md already exists:
git status
git diff --cached --stat
If files need staging:
git add <specific-files>
Important: Never use git add -A or git add . - always add specific files to avoid accidentally committing sensitive files.
Based on the changes:
feat: new featurefix: bug fixdocs: documentationrefactor: code refactoringtest: testschore: maintenancegit commit -m "$(cat <<'EOF'
<type>: <description>
<optional body>
Co-Authored-By: Claude <noreply@anthropic.com>
EOF
)"
git push origin <branch>
If push fails due to upstream changes:
git pull --rebase origin <branch>
git push origin <branch>
If user requests PR creation:
gh pr create --title "<title>" --body "$(cat <<'EOF'
## Summary
- Change 1
- Change 2
## Test Plan
- [ ] Test 1
- [ ] Test 2
---
Generated with [Claude Code](https://claude.ai/code)
EOF
)"
/github-about)After pushing, automatically run the /github-about skill to update the repo's About section.
The /github-about skill will:
Simply invoke /github-about — it handles authentication, detection, and updates automatically.
After /github-about completes, also enable discussions if not already enabled:
gh repo view --json hasDiscussionsEnabled
If discussions are NOT enabled:
gh repo edit --enable-discussions
/create_github_readme skill/github-about to set repo description, live site URL, and topics| Category | Examples |
|---|---|
| Cloud Credentials | AWS, GCP, Azure, Heroku |
| API Keys | OpenAI, Anthropic, Stripe, Twilio, SendGrid |
| Auth Tokens | OAuth, Bearer, JWT, Session tokens |
| Database URLs | PostgreSQL, MySQL, MongoDB, Redis |
| Private Keys | RSA, DSA, EC, SSH, PGP |
| Platform Tokens | GitHub, Slack, Discord webhooks |
| Generic Secrets | Passwords, credentials, secrets in code |
After running /github_push:
Weekly Installs
0
Repository
GitHub Stars
1
First Seen
Jan 1, 1970
Security Audits
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
144,300 周安装
id_ecdsaid_ed25519*.keystore, *.jks (Java keystores).htpasswd, .netrc, .npmrc (auth files)wp-config.php (WordPress config)database.yml with credentialssettings.py with SECRET_KEY