secret-handling

Prohibit agents from reading .env files and committing secrets to .squad/ files.

Updated Apr 10, 2026

Search Tags:#pre-commit #security-guardrails #credential-protection #git-safety #env-files #secret-handling

Ready to run

npx skills add https://github.com/chdaly/eshop --skill secret-handling-chdaly

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-handling
Source: https://github.com/chdaly/eshop/tree/main/.copilot/skills/secret-handling
Command: npx skills add https://github.com/chdaly/eshop --skill secret-handling-chdaly

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill codifies absolute prohibitions against reading sensitive environment files and writing secrets to .squad/ committed files, preventing credential leakage across automated agents and git workflows.

Core Features & Use Cases

Prohibits reading of sensitive files such as .env and .env.* patterns.
Blocks committing secrets to .squad/ and maintains safeguards through pre-commit checks.
Provides safe alternatives like .env.example, .env.sample, and explicit remediation guidance when secrets are exposed.

Quick Start

Enable pre-commit validation to scan for secrets in staged changes and block commits containing sensitive data.

Frequently Asked Questions about secret-handling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent credentials from leaking through .env files in git commits?▼

Preventing credential leakage requires prohibiting automated agents from reading .env files and blocking writes of secrets to committed files. This skill enforces strict environment handling and pre-commit checks to block dangerous commits.

How do I set up pre-commit checks to block secrets from being committed?▼

Setting up pre-commit validation scans staged changes for sensitive data and blocks commits containing secrets before they enter git history. This provides a security guardrail that stops credential exposure during automated workflows.

What is a safe alternative to committing .env files for environment configuration?▼

Safe alternatives to committing .env files include using .env.example or .env.sample templates. These allow you to share configuration structures without exposing actual credentials, maintaining git safety across automated agents.

How do I remediate secrets that were accidentally committed to a git repository?▼

Remediation guidance for exposed secrets involves following explicit env handling protocols to identify and remove leaked credentials from committed files. You must scan your git history to locate sensitive data and secure the repository.

Can I use this secret-handling approach to protect credentials across automated agents?▼

Yes, this approach precludes credential leakage by prohibiting agents from reading sensitive environment files and writing secrets to committed files. It ensures safe alternatives exist and enforces pre-commit checks for automated git workflows.

What limitations exist when blocking secrets in pre-commit git workflows?▼

A key limitation is that if secrets bypass pre-commit checks and enter git history, the skill cannot automatically rewrite past commits. It provides remediation guidance for exposed secrets, but manual intervention is required to scrub committed credentials.