omk-secret-guard

To prevent environment variables and private keys from leaking during agent coding workflows, you can use a Skill that enforces a protected-file denylist. It blocks writing, printing, or committing secret files like .env and credential JSON during repository edits.

The agent stops and asks for permission when handling .env files or service-account credentials because of a safe escalation mechanism. It halts workflows that risk exposing secrets, requiring explicit user action to provide the needed input safely.

Repository security skills block common secret file patterns from being committed or summarized, including .env files, private keys, and service-account credential JSON. This prevents inadvertent disclosure of sensitive data during documentation or debugging tasks.

Yes, you can use a credential leakage prevention skill to block secret access during debugging tasks. It specifically applies to workflows like authentication debugging, refusing to output or propagate key material and requiring safe user input instead.

To configure agent safety rules to restrict writing to environment files, you apply a Skill that enforces a protected-file denylist. This mechanism automatically blocks the agent from writing, printing, or propagating environment files and key material.