secret-handling

Prohibit agents from reading .env files and committing secrets to .squad files.

Updated Aug 23, 2026

Search Tags:#pre-commit #redaction #secret-management #git-ops #env-files #credential-security

Ready to run

npx skills add https://github.com/CarlosSardo/nats-poc-simulator --skill secret-handling-carlossardo

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-handling
Source: https://github.com/CarlosSardo/nats-poc-simulator/tree/main/.copilot/skills/secret-handling
Command: npx skills add https://github.com/CarlosSardo/nats-poc-simulator --skill secret-handling-carlossardo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents agents from reading live secret files and writing secrets to the squad workspace, protecting credentials and reducing leakage risk.

Core Features & Use Cases

Prohibits reading sensitive env files such as .env, .env.local, and similar; suggests safe alternatives like .env.example or .env.template
Enforces pre-commit validation to scan staged files for secret patterns and blocks commits containing credentials
Provides remediation guidance for secrets accidentally committed and established safety workflow

Quick Start

Consult .env.example for the schema and never read live secret files; if needed, prompt the user for values and replace secrets with placeholders before committing.

Frequently Asked Questions about secret-handling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent AI agents from reading environment files and leaking secrets?▼

Preventing AI agents from leaking secrets requires forbidding them from reading live environment files. This approach enforces safe alternatives like .env.example and applies pre-commit validation to block credentials from entering committed files.

How does pre-commit validation stop credential exposure in git operations?▼

Pre-commit validation stops credential exposure by scanning staged files for secret patterns before they are committed. It blocks commits containing credentials and provides remediation guidance for any secrets accidentally committed to the repository.

What is the best way to manage env files safely during code repository onboarding?▼

The best way to manage env files safely during onboarding is to consult .env.example for the schema and never read live secret files. You should prompt users for values and replace secrets with placeholders before committing.

Can I use .env.example as a safe alternative to .env files for automation?▼

Yes, you can use .env.example as a safe alternative to .env files for automation. It provides the necessary schema without exposing live secrets, allowing agents to understand configuration structures while maintaining credential security.

What should I do if secrets are accidentally committed to a squad workspace?▼

If secrets are accidentally committed to a squad workspace, you should follow established remediation guidance to remove them. Pre-commit validation is designed to block these commits, but remediation steps exist to handle accidental credential leakage.