bridge-leak-checklisted

Content-leak scanner with categorized classification. Different from a raw blocklist grep: each hit is sorted into legitimate-self-reference, legitimate-sister-repo, personal-PII (always leak), or internal-vocabulary hardcoded (OSS-strict only). Use after a sync to verify the destination is actually clean — catches pre-existing leaks the source-side scan won't see. Also runs OSS-strictness vocabulary checks (e.g. "scope: bks" hardcoded in OSS-shipped skill docs that should use "scope: org" placeholder). Trigger: "/bridge-leak-check", "leak scan", "leak check", "OSS readiness", "pre-existing leaks", "cleanliness check", "is this OSS clean".
bks-lab/open-bridge · ★ 8 · AI & Automation · score 74

Install: claude install-skill bks-lab/open-bridge

# Bridge Leak Check — Categorized Content Scan `bridge-leak-check` runs over a *current repo state* (not a diff), greps the configured blocklists, and **categorizes** every hit into one of four buckets so you don't drown in false positives. It complements `rules/promote-safety.md` (which scans a diff per-destination at promote time) by running on the **post-merge** state. Read the referenced file ONLY when triggered. ## Why both scans exist | Scan | When | Scope | Strength | |---|---|---|---| | `rules/promote-safety.md` | At promote time | Diff only | Catches leaks introduced by the current commit | | `bridge-leak-check` | Anytime | Whole repo state | Catches pre-existing leaks (from prior promotes, seedings, manual commits) | The session that birthed this skill discovered that a clean source-side scan does not guarantee a clean destination — `open-bridge` had three pre-existing leaks (`<your-username>-bks.yaml` examples, `com.bks.my-service`, `bks` wordmark) that no single promote scan caught because they predated the per-repo blocklist. ## Arguments | Argument | Effect | Default | |---|---|---| | `(none)` | Scan current repo with the matching blocklist (auto-detected from `.git/config` origin) | — | | `--repo <name>` | Force which blocklist to apply (`open-bridge` / `org-overlay` / `your-bridge` / `fallback`) | auto | | `--strict-oss` | Also flag internal-vocabulary hardcoding (uses `vocabulary_renames` from `bridge-audit/data/renames.yaml`) | false | | `--report-onl