hook-protect-secrets

Block secret file access by enforcing PreToolUse hooks that detect sensitive file patterns and environment-variable dumps. This Skill provides structured detection patterns across files, Bash commands, and exfiltration attempts to deny unauthorized access automatically.

Protect against 33 sensitive file patterns, 24 Bash patterns, and 15 exfiltration patterns. The Skill guides you through auditing token-scope-guard.sh, adding new patterns, and reviewing protected secret paths for ongoing security hardening.

Yes, safe-file exemptions are included for .env.example, .env.sample, and .env.template files. The hook implementation differentiates allowed vs blocked actions using standard hook exit codes to determine allow/deny outcomes.

Add new secret detection patterns by following the step-by-step guidance to update the hook implementation, run tests, and update review dates. This ensures ongoing security hardening as new credential exfiltration techniques emerge.

Yes, the pattern-based detection requires no external dependencies or components. It relies entirely on enforcing PreToolUse hooks with standard exit codes to determine allow/deny outcomes for sensitive file and environment-variable access.

Pattern-based detection provides immediate, deterministic blocking of known sensitive file paths and exfiltration commands. It offers transparent, auditable rules with safe-file exemptions, unlike opaque methods, making it ideal for reviewing and hardening protected secret paths.