Audit Git repositories for security issues, large files, sensitive data, and repository health metrics.
A CLI tool to audit Git repositories for security issues, code quality problems, and repository health. Scan repositories for secrets, large files, sensitive data, and common security anti-patterns.
Key features:
Basic commands:
# Scan current directory repository
python3 scripts/main.py scan .
# Scan specific repository path
python3 scripts/main.py scan /path/to/repo
# Scan with custom secrets patterns file
python3 scripts/main.py scan . --patterns custom-patterns.json
# Generate JSON report for automation
python3 scripts/main.py scan . --json
# Check only for large files (>50MB)
python3 scripts/main.py scan . --check large-files --threshold 50
# Scan specific branch or commit range
python3 scripts/main.py scan . --branch main --since "2024-01-01"
# Generate remediation report with suggested fixes
python3 scripts/main.py scan . --remediation
# List all branches with last commit age
python3 scripts/main.py branches .
python3 scripts/main.py scan ~/projects/my-app
Output:
🔍 Scanning repository: /home/user/projects/my-app
📊 Repository info: 247 commits, 5 branches, 3 contributors
🔐 SECURITY ISSUES FOUND (3):
⚠️ High: AWS_ACCESS_KEY_ID found in commit abc123 (2024-02-15)
File: config/old-config.env
Pattern: AWS_ACCESS_KEY_ID=AKIA.*
Remediation: Rotate key immediately, remove from history with BFG
⚠️ Medium: Hardcoded database password in commit def456 (2024-01-20)
File: src/database.js
Pattern: password: "secret123"
Remediation: Move to environment variables, use secret manager
⚠️ Low: Private key file extension in commit ghi789 (2023-12-05)
File: backup/id_rsa.old
Pattern: Private key file (.pem, .key, .ppk, id_rsa)
Remediation: Remove file from repository history
💾 LARGE FILES FOUND (2):
📦 42MB: assets/video/demo.mp4 (commit xyz123)
📦 18MB: database/backup.sql (commit uvw456)
✅ Repository health: Good
⏰ Stale branches: 2 branches older than 90 days
python3 scripts/main.py scan . --json > security-report.json
Output (excerpt):
{
"repository": "/home/user/projects/my-app",
"scan_date": "2024-03-06T10:30:00Z",
"security_issues": [
{
"severity": "high",
"type": "aws_access_key",
"commit": "abc123",
"date": "2024-02-15",
"file": "config/old-config.env",
"pattern": "AWS_ACCESS_KEY_ID=AKIA.*",
"remediation": "Rotate key immediately, remove from history with BFG"
}
],
"large_files": [
{
"size_mb": 42,
"path": "assets/video/demo.mp4",
"commit": "xyz123"
}
],
"summary": {
"total_issues": 3,
"by_severity": {"high": 1, "medium": 1, "low": 1},
"large_files_count": 2,
"total_size_mb": 60
}
}
python3 scripts/main.py health .
Output:
📈 Repository Health Report: /home/user/projects/my-app
📊 Basic Metrics:
- Commits: 1,247
- Branches: 12 (3 active, 9 stale)
- Contributors: 8
- First commit: 2022-05-15
- Last commit: 2024-03-06
⚠️ Health Issues:
- Stale branches: 9 branches with no commits in >90 days
- Large files: 2 files >10MB in history
- Binary files: 45 binary files (consider Git LFS)
- Merge conflicts: 3 unresolved merge markers in code
✅ Good Practices:
- .gitignore present and comprehensive
- No secrets detected in recent commits
- Regular commit activity (avg 15 commits/week)
- Meaningful commit messages (87% good)
💡 Recommendations:
1. Clean up stale branches: git branch -d branch1 branch2...
2. Consider Git LFS for binary files
3. Resolve merge conflicts in: src/app.js, config/settings.yaml
python3 scripts/main.py scan . --check large-files --threshold 20
Output:
💾 Large Files (>20MB) in Repository History:
1. assets/videos/presentation.mp4
- Size: 42MB
- Commit: xyz123 (2024-01-15)
- Author: Jane Doe
- Message: "Add presentation video"
2. database/backup/archive.sql.gz
- Size: 38MB
- Commit: uvw456 (2023-12-20)
- Author: John Smith
- Message: "Database backup"
Total: 2 files, 80MB
Recommendation: Consider using Git LFS for files >20MB
The tool works with any local Git repository. No special configuration directories are required, but you can provide custom patterns files for secrets detection.
This is a skill built by the Skill Factory. Issues and improvements should be reported through the OpenClaw project.
ZIP package — ready to use