Specstory Guard

If you're using SpecStory to track AI coding sessions, this installs a pre-commit hook that scans your .specstory/history directory for accidentally captured secrets before they hit your repository. It catches the usual suspects like AWS keys, bearer tokens, and private keys, then blocks the commit until you redact them. The hook runs automatically, the scan is fast (under a second for hundreds of files), and you can allowlist false positives with regex patterns. Smart safety net for a real problem: API keys you pasted into chat or credentials that showed up in command output can easily end up in your history files without you noticing.

skills.sh installs: 262
GitHub stars: 35
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add specstoryai/agent-skills --skill specstory-guard --agent claude-code

Installs into .claude/skills of the current project.

Files

SpecStory Guard

A pre-commit guardrail that scans .specstory/history for potential secrets and blocks commits until they are removed or redacted.

How It Works

Installs a git pre-commit hook in your repository
Scans .specstory/history files on every commit
Detects common secret patterns (API keys, tokens, private keys)
Blocks the commit if secrets are found
Reports findings with redacted previews for safe review

Why Use Guard?

AI coding sessions may inadvertently capture sensitive data:

API keys you pasted into chat
Environment variables in command output
Private keys or tokens in error messages
Credentials in configuration examples

Guard prevents accidental commits of these secrets.

Usage

Slash Command

User says	Action
`/specstory-guard`	Install the pre-commit hook
`/specstory-guard install`	Install the pre-commit hook
`/specstory-guard scan`	Run a manual scan without installing
`/specstory-guard check`	Alias for scan
`/specstory-guard uninstall`	Remove the pre-commit hook