secret-handling

What problem does it solve? AI agents with repository access can read .env files containing live credentials and accidentally write those secrets into committed team files, leaking them into git history. This Skill codifies absolute prohibitions and safe alternatives to prevent credential exposure. ## Core Features & Use Cases - Prohibited File Rules: Blocks reading of .env, .env.local, .env.production, and other environment files while allowing safe templates like .env.example and .env.sample. - Secret Pattern Detection: Provides regex patterns for detecting API keys, passwords, connection strings, JWT tokens, private keys, AWS credentials, and email addresses in staged content. - Pre-Commit Validation: Defines a scanning workflow that blocks commits containing secrets, unstages offending files, and reports violations before any git commit proceeds. - Leak Remediation Protocol: Outlines steps for responding when a secret is found in git history, including credential revocation and history cleanup guidance. - Use Case: An agent needs database configuration details. Instead of reading .env and writing the live connection string into a decision log, it reads .env.example and documents only the schema with placeholder values. ## Quick Start Apply the secret-handling rules to ensure no .env files are read and no credentials are written to committed team files.