sakebomb

Leakguard — AI skill for Claude Code

AI community

Stop AI coding agents from leaking your machine identity and home network into public git history.

How to install Leakguard

This entry records only its repository, not the path inside it, so there is no exact command to give. Open sakebomb/leakguard and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Leakguard does

Stop AI coding agents from leaking your machine identity and home network into public git history. CLI + GitHub Action.

Alternatives in AI

Memory Forge Rs — Stop resetting satisfying AI chats — edit the memory instead 474 ★
Memtrace Public — Structural memory for AI coding agents 466 ★
Ataru — High-performance AI memory retrieval for local agent history — a Rust search core (SDK / API / JSON CLI) plus 351 ★

README

leakguard

Stop AI coding agents (and plain git) from leaking your machine identity and internal network into **public** git history.

The problem

When `user.email` is unset, git auto-invents `user@`. On a self-hosted box with mDNS that becomes `user@nas.local`, `user@MacBook-Pro.local`. AI agents (Claude Code, Cursor, Aider) then co-sign public commits with that identity, and their diffs paste internal hostnames, LAN IPs (`192.168.x`, `10.x`), and home paths into permanent public history.

In a passive study of public GitHub commit search, roughly **1 in 3** home-server-identity commits leaked an internal hostname, and about **91%** resolved to a real GitHub account. The machine name, its OS and hardware, the AI agent and model, the operator's timezone, and the operator themselves are all recoverable from data that can never be edited out.

Install

`leakguard` is three dependency-free files (`leakguard.py` + `detectors.py` + `map_render.py`). Clone or copy them, then put it on your PATH:

git clone https://github.com/sakebomb/leakguard
alias leakguard='python3 /path/to/leakguard/leakguard.py'

Requires only Python 3 and git.

What it detects

`hook`/`ci` **block** a commit on: machine identity (LAN commit identity, mDNS `.local`/`.lan`/ `.internal` hosts, Tailscale tailnet names), internal topology (private IPs, home paths), **30+ provider secrets** (AWS, GitHub/GitLab PATs, Stripe, npm/PyPI, OpenAI/Anthropic, Slack, SendGrid, Google, DigitalOcean, PEM private keys), embedded credentials in `scheme://…:pass@host` URLs, and sensitive files (`id_rsa`, `*.pfx`/`*.p12`/`*.jks`, `.npmrc`, `.aws/credentials`, `kubeconfig`, `.env` — sample files allowed). It also enforces a large-file tripwire and scans commit messages.

High-precision by design: a keyword pre-filter, an allowlist layer, and a placeholder-value denylist keep false positives low, and findings are **masked** — the raw secret is never printed. Noisier signals (entropy, generi