---

name: repo-security-clean description: Scans repository for security issues and automatically remediates them. Use when the user asks to "clean up security issues", "fix security problems", "remove sensitive data", "sanitise the repo", or "/repo-security-clean". More aggressive than /repo-security-scan - this skill takes action. allowed-tools: Bash,Read,Write,Edit,Glob,Grep,AskUserQuestion

Repository Security Clean

Scans the repository for security issues and automatically remediates them. This is the action-oriented companion to /repo-security-scan.

Invocation

/repo-security-clean
"clean up security issues"
"fix the security problems"
"remove sensitive data from the repo"
"sanitise this repository"

Prerequisites

First run /repo-security-scan to generate a report, OR this skill will run a scan first.

Workflow

Step 1: Check for Existing Scan

Look for recent scan report:

ls -t security/*-scan.md 2>/dev/null | head -1

If scan exists from today: Use it If no recent scan: Run /repo-security-scan first

Step 2: Parse Findings

Read the scan report and extract actionable items (High and Medium priority).

Build a remediation queue:

[H1] Hardcoded API key in config/services.rb:42
[H2] Private key tracked in certs/server.key
[M1] SQL injection risk in app/models/user.rb:87
[M2] Debug mode enabled in config/production.yml

Step 3: Confirm Scope

Present findings and ask for confirmation:

Found 4 issues to remediate:

High Priority (2):
  [H1] Hardcoded API key - config/services.rb:42
  [H2] Private key tracked - certs/server.key

Medium Priority (2):
  [M1] SQL injection risk - app/models/user.rb:87
  [M2] Debug mode enabled - config/production.yml

Options:
  - Fix all (recommended)
  - Fix High only
  - Select individually
  - Cancel

Step 4: Remediate Each Issue

Process each issue based on its type:

---

Hardcoded Secrets

Detection: API keys, passwords, tokens in code

Remediation:

1. Identify the secret type and variable name
2. Add to .env.example with placeholder:

   API_KEY=your_api_key_here
   

3. Update code to read from environment:

   # Before
   api_key = "sk-abc123..."
   
   # After
   api_key = ENV.fetch('API_KEY')
   

4. Ensure .env is in .gitignore
5. Warn user: "Secret was exposed in git history. Rotate this credential immediately."

---

Tracked Sensitive Files

Detection: Private keys, credentials files, .env files in git

Remediation:

1. Add pattern to .gitignore:

   *.pem
   *.key
   .env
   

2. Remove from git tracking (keep file):

   git rm --cached <file>
   

3. Ask user: "Remove from git history entirely? (requires force push)"
   • If yes: Use git filter-repo or BFG
   • If no: Just untrack, warn about history

---

SQL Injection

Detection: String interpolation in queries

Remediation:

# Before
User.where("name = '#{params[:name]}'")

# After
User.where(name: params[:name])

For complex queries:

# Before
User.where("name LIKE '%#{params[:q]}%'")

# After
User.where("name LIKE ?", "%#{params[:q]}%")

---

Command Injection

Detection: User input in system/exec calls

Remediation:

# Before
system("convert #{params[:file]} output.png")

# After
system("convert", params[:file], "output.png")

For shell commands, use array form or escape:

# Using Shellwords
require 'shellwords'
system("convert #{Shellwords.escape(params[:file])} output.png")

---

XSS Vulnerabilities

Detection: raw, html_safe on user input, innerHTML

Remediation:

# Before
<%= raw user_input %>

# After
<%= sanitize user_input %>

// Before
element.innerHTML = userInput;

// After
element.textContent = userInput;

---

Insecure Configuration

Detection: Debug mode, permissive CORS, missing CSRF

Remediation:

Debug mode:

# Before
debug: true

# After
debug: false  # or use environment variable

CORS wildcard:

# Before
config.allowed_origins = '*'

# After
config.allowed_origins = ENV.fetch('ALLOWED_ORIGINS', 'https://myapp.com').split(',')

---

Weak Cryptography

Detection: MD5, SHA1 for passwords, weak random

Remediation:

# Before
Digest::MD5.hexdigest(password)

# After
BCrypt::Password.create(password)

// Before
Math.random().toString(36)

// After
crypto.randomUUID()

---

Step 5: Update .gitignore

Consolidate all patterns that should be ignored:

# Check current .gitignore
cat .gitignore

# Add missing patterns
echo "
# Security - added by repo-security-clean
.env
.env.*
*.pem
*.key
*.p12
config/master.key
" >> .gitignore

Step 6: Create Commit

Stage all changes and create a security fix commit:

git add -A
git commit -m "security: remediate issues from security scan

Fixed:
- [H1] Moved API key to environment variable
- [H2] Removed private key from tracking
- [M1] Fixed SQL injection in User model
- [M2] Disabled debug mode in production

Run 'git log --oneline -1' to see this commit.

⚠️  Action required:
- Rotate exposed credentials
- Review git history for sensitive data
"

Do NOT auto-commit - present the changes and ask:

Ready to commit these security fixes?

Changes:
  M  .gitignore
  M  config/services.rb
  M  app/models/user.rb
  D  certs/server.key (untracked, file preserved)

Options:
  - Commit now
  - Review changes first (git diff)
  - Cancel

Step 7: Post-Remediation Report

Update the scan report or create a new one:

# Security Clean Report

**Repository:** <repo-name>
**Date:** YYYY-MM-DD
**Action:** Automated remediation

## Actions Taken

### [H1] Hardcoded API Key - FIXED
- **File:** config/services.rb:42
- **Action:** Replaced with `ENV.fetch('API_KEY')`
- **Follow-up required:** Rotate the exposed key

### [H2] Private Key Tracked - FIXED
- **File:** certs/server.key
- **Action:** Added to .gitignore, removed from tracking
- **Follow-up required:** Consider removing from git history

## Manual Actions Required

1. **Rotate credentials:**
   - [ ] API key (was exposed in config/services.rb)
   - [ ] Any other secrets visible in git history

2. **Clean git history (optional but recommended):**
   ```bash
   # Install BFG Repo-Cleaner
   brew install bfg

   # Remove sensitive files from history
   bfg --delete-files server.key
   git reflog expire --expire=now --all
   git gc --prune=now --aggressive
   git push --force

3. Enable secret scanning:
   • GitHub: Settings → Security → Secret scanning
   • Add pre-commit hooks for local detection

Summary

Priority	Found	Fixed	Manual
High	2	2	0
Medium	2	2	0
Low	5	0	5

### Step 8: Final Summary

✓ Security clean complete

Fixed: 4 issues [H1] Hardcoded API key → environment variable [H2] Private key → untracked [M1] SQL injection → parameterised query [M2] Debug mode → disabled

Commit ready: Run 'git push' when ready

⚠️ Manual actions required: 1. Rotate the exposed API key 2. Consider cleaning git history 3. Review low-priority items in report

Report: security/YYYYMMDD-clean.md

## Safety Guardrails

1. **Always ask before:**
   - Modifying git history
   - Deleting files
   - Making commits

2. **Never automatically:**
   - Force push
   - Delete untracked files
   - Modify files outside the repo

3. **Preserve originals:**
   - Untrack sensitive files, don't delete them
   - User may need the actual credentials/keys

4. **Warn about:**
   - Exposed secrets in git history
   - Credentials that need rotation
   - Breaking changes (e.g., code now requires env vars)

## Limitations

- Cannot fix all vulnerability types automatically
- Some fixes may require manual review (complex SQL, business logic)
- Git history cleaning requires manual steps
- Does not rotate credentials (user must do this)