# PreCommitSanitize

> Scan staged files for hardcoded home paths, personal identifiers, symlinks, and runtime state before committing to the ~/.claude repo. USE WHEN staging or committing in ~/.claude, or before pushing a dotfiles/config repo to a public GitHub remote.

- **Type:** Skill
- **Install:** `agentstack add skill-rohirik-claude-code-config-precommitsanitize`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [RohiRIK](https://agentstack.voostack.com/s/rohirik)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [RohiRIK](https://github.com/RohiRIK)
- **Source:** https://github.com/RohiRIK/claude-code-config/tree/main/skills/PreCommitSanitize

## Install

```sh
agentstack add skill-rohirik-claude-code-config-precommitsanitize
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Pre-Commit Sanitization

## When This Applies

Before every `git add` or `git commit` in `~/.claude`, scan staged files for sensitive personal information that should not be pushed to a public GitHub repository.

## What to Catch

### Hardcoded Home Paths

Any absolute path containing a username or home directory:

| Pattern | Example | Fix |
|---------|---------|-----|
| `/Users//` | `/Users/jane/.claude/hooks/...` | `~/.claude/hooks/...` |
| `/home//` | `/home/deploy/.claude/...` | `~/.claude/...` |
| `C:\Users\\` | `C:\Users\jane\...` | `~\.claude\...` |

Exception: `.gitignore` rules may use relative paths that are fine.

### Personal Identifiers

| Pattern | Example | Action |
|---------|---------|--------|
| Email addresses | `jane@gmail.com` | Remove or replace with `user@example.com` |
| Social media handles | `linkedin.com/in/` | Remove unless intentionally public (README author section) |
| Machine hostnames | `-MacBook-Pro.local` | Remove |
| Usernames in paths | username embedded in file content | Replace with `~` or `$HOME` |

Exception: `README.md` author/contact section may intentionally include social links — confirm before removing.

### Symlinks

**Rule: No symlink inside `~/.claude/` may be committed to git.**

Symlinks are always machine-specific — they point to absolute paths on the local filesystem that don't exist on other machines. Committing them breaks clones and leaks personal paths.

| Action | When |
|--------|------|
| Add to `.gitignore` under `# Symlinks` section | When creating any new symlink inside `~/.claude/` |
| Run `git rm --cached ` | If a symlink was accidentally tracked |

The `hooks/git/pre-commit` hook **auto-detects and blocks** staged symlinks (git mode `120000`) and adds them to `.gitignore` automatically. This is a safety net — always add manually first.

**Pattern for `.gitignore`:**
```
# Symlinks (local-only, machine-specific — never commit symlinks to shared tools)
# Rule: ANY symlink inside ~/.claude/ must be listed here.
skills/MySkilLink
```

### Runtime State Files

Files that are managed by Claude Code at runtime and should not be version-controlled:

| File/Pattern | Why |
|-------------|-----|
| `plugins/installed_plugins.json` | Contains absolute install paths with username |
| `plugins/known_marketplaces.json` | Contains absolute install paths with username |
| `plugins/install-counts-cache.json` | Runtime cache |
| `security_warnings_state_*.json` | Session-specific state |
| `stats-cache.json` | Runtime cache |
| `settings.json.bak` | Backup file |
| `*.db`, `*.db-shm`, `*.db-wal` | Database files |
| `history.jsonl` | Session history |

If any of these appear in `git status` as tracked, run `git rm --cached ` and add to `.gitignore`.

## How to Check

Before staging, run this scan on all files being committed:

```bash
# Check for hardcoded home paths in staged files
git diff --cached --name-only | xargs grep -n '/Users/\|/home/\|C:\\Users\\' 2>/dev/null
```

If matches are found:
1. For `settings.json` hook commands — these **require** absolute paths (Claude Code limitation). Add `settings.json` to `.gitignore` if it contains paths, or accept this as a known trade-off and document it.
2. For all other files — replace with `~/.claude/` or `$HOME/.claude/`.
3. For comments/docs — use `~/.claude/` notation.

## Automated Enforcement

The `hooks/git/pre-commit` hook runs `bunx varlock scan --staged` for secret detection. For path sanitization, manually verify before committing or add a grep check to the pre-commit hook:

```bash
# Add to hooks/git/pre-commit after varlock scan
if git diff --cached --name-only | xargs grep -l '/Users/' 2>/dev/null | grep -v 'settings.json' | grep -qv '.gitignore'; then
  echo "[pre-commit] WARNING: Hardcoded /Users/ paths found in staged files" >&2
  git diff --cached --name-only | xargs grep -n '/Users/' 2>/dev/null | grep -v 'settings.json' | grep -v '.gitignore' >&2
  echo "[pre-commit] Replace with ~/.claude/ before committing" >&2
  exit 1
fi
```

## Known Trade-offs

`settings.json` hook commands require absolute paths — Claude Code does not expand `~` or `$HOME` in hook command strings. Options:
1. **Gitignore settings.json** — loses version control on hook config
2. **Accept the path leak** — username visible but not a security risk
3. **Use env var in a wrapper** — hook commands call a shell script that resolves `$HOME`

Current decision: keep `settings.json` tracked, accept that the username is visible. The file contains no secrets — only hook wiring with absolute paths.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [RohiRIK](https://github.com/RohiRIK)
- **Source:** [RohiRIK/claude-code-config](https://github.com/RohiRIK/claude-code-config)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-rohirik-claude-code-config-precommitsanitize
- Seller: https://agentstack.voostack.com/s/rohirik
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.