# Sanitize Project

> Sanitize and clean a project directory for public sharing. Use this skill whenever the user gives a file path and wants to package, share, or zip a project — even if they just say 'clean this up', 'prep this for sharing', 'sanitize this folder', 'remove my API keys', or 'package this project'. Also trigger when the user says /sanitize-project followed by a path. Handles removing build artifacts,…

- **Type:** Skill
- **Install:** `agentstack add skill-duncan-buildroom-profit-room-skills-sanitize-project`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [duncan-buildroom](https://agentstack.voostack.com/s/duncan-buildroom)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [duncan-buildroom](https://github.com/duncan-buildroom)
- **Source:** https://github.com/duncan-buildroom/profit-room-skills/tree/main/skills/sanitize-project

## Install

```sh
agentstack add skill-duncan-buildroom-profit-room-skills-sanitize-project
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Sanitize Project for Public Sharing

Clean up a project directory so it's safe and lightweight to share publicly. The goal: remove everything that's either private (credentials, keys) or regenerable (build output, dependencies).

---

## STEP 1: Parse the Path

Get the target directory from the user's argument. If no path was given, ask for one.

Check that the directory exists before proceeding.

---

## STEP 2: Copy First, Sanitize the Copy

**Always sanitize a copy — never the original.** The original stays untouched with its original name.

```bash
# The copy gets a "- Community" suffix (or similar distribution label)
COPY_DIR="${ORIGINAL_DIR} - Community"
cp -r "$ORIGINAL_DIR" "$COPY_DIR"
```

All subsequent steps operate on `$COPY_DIR`, not the original. Tell the user:
- Original preserved at: ``
- Sanitizing copy at: ``

---

## STEP 3: Measure Before Size

```bash
du -sh "$COPY_DIR"
```

Save this number — you'll report it at the end.

---

## STEP 4: Remove Build Artifacts & Caches

These are all regenerated automatically when the project is run — safe to delete:

```bash
# Remove each if it exists
node_modules/
.next/
.nuxt/
dist/
build/
.turbo/
.cache/
.parcel-cache/
__pycache__/
*.pyc
.pytest_cache/
.venv/
venv/
tsconfig.tsbuildinfo
*.tsbuildinfo
.DS_Store (all, recursively)
```

Use `find` + `rm -rf` to handle nested occurrences (e.g. nested `node_modules`).

Example:
```bash
find "/path/to/project" -name "node_modules" -type d -prune -exec rm -rf {} +
find "/path/to/project" -name ".DS_Store" -delete
```

---

## STEP 5: Remove Lock Files

These are regenerated by `npm install` / `pip install` etc:

- `package-lock.json`
- `yarn.lock`
- `pnpm-lock.yaml`
- `Pipfile.lock`
- `poetry.lock`
- `Gemfile.lock`

---

## STEP 6: Remove Version Control

```bash
.git/
.svn/
.hg/
```

The recipient doesn't need the git history.

---

## STEP 7: Scan for Secrets & Credentials

Search ALL remaining files for patterns that suggest credentials. This is the most important step — missing a real API key in a public share is a serious problem.

Patterns to search for (case-insensitive):
- `API_KEY`, `APIKEY`
- `SECRET`, `SECRET_KEY`
- `TOKEN`, `ACCESS_TOKEN`, `AUTH_TOKEN`
- `PASSWORD`, `PASSWD`, `PWD`
- `PRIVATE_KEY`, `PRIVATE KEY`
- `-----BEGIN RSA PRIVATE KEY-----`
- `sk-` (OpenAI key prefix)
- `sk-ant-` (Anthropic key prefix)
- `Bearer `
- Common cloud prefixes: `AKIA` (AWS), `AIza` (Google)

Use grep to scan:
```bash
grep -rli "API_KEY\|SECRET\|TOKEN\|PASSWORD\|sk-\|AKIA\|AIza\|Bearer" /path/to/project \
  --include="*.env*" --include="*.json" --include="*.ts" --include="*.js" \
  --include="*.py" --include="*.yaml" --include="*.yml" --include="*.toml" \
  --include="*.sh" --include="*.conf" --include="*.config"
```

For each file flagged:
- Read the file
- Determine if the match is an actual credential value (e.g. `OPENAI_API_KEY=sk-abc123`) or just a variable reference/placeholder (e.g. `OPENAI_API_KEY=your-key-here`)
- Only warn/redact actual values, not placeholders

---

## STEP 8: Handle .env Files

For any `.env`, `.env.local`, `.env.production`, `.env.development` files found:

1. Read the file
2. Check if it contains real values (not just placeholders like `your-key-here`, `xxxxx`, ``)
3. If it has real values:
   - Create a `.env.example` that strips the values but keeps the key names:
     ```
     OPENAI_API_KEY=
     NEXT_PUBLIC_SUPABASE_URL=
     ```
   - Delete the original `.env` file with real values
4. If `.env.example` already exists and the `.env` only has real values, just delete `.env`
5. Tell the user which files were redacted

---

## STEP 9: Measure After Size

```bash
du -sh "$COPY_DIR"
```

---

## STEP 10: Report

Print a clean summary:

```
✅ Sanitization complete

📁 Original (untouched): /path/to/project
📦 Community copy: /path/to/project - Community
📦 Before: 458 MB → After: 268 KB

Removed:
  ✓ node_modules/ (458 MB)
  ✓ .next/ (309 MB)
  ✓ .git/ (648 KB)
  ✓ package-lock.json
  ✓ tsconfig.tsbuildinfo
  ✓ 3x .DS_Store files

Credentials:
  ✓ .env.local → replaced with .env.example (stripped real values)
  ⚠️  Possible credential pattern found in: src/config.ts — review manually

Ready to zip:
  zip -r MyProject.zip /path/to/project
```

If any files were flagged as potentially containing credentials but NOT auto-redacted (because they're code files, not env files), call them out explicitly so the user can review manually.

---

## Notes

- Never delete files outside the target directory
- Be conservative: if unsure whether something is a real credential vs a placeholder, flag it for the user rather than silently redacting
- If the project has a `.gitignore`, use it as a hint — anything in `.gitignore` is often a good candidate for removal

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [duncan-buildroom](https://github.com/duncan-buildroom)
- **Source:** [duncan-buildroom/profit-room-skills](https://github.com/duncan-buildroom/profit-room-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-duncan-buildroom-profit-room-skills-sanitize-project
- Seller: https://agentstack.voostack.com/s/duncan-buildroom
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.