skills.rest
Golnaz89
Golnaz89COMMUNITY
Explore all skills by this author β†’
Website𝕏@Golnaz89GitHub

secret-handling

Prevent credential leakage by blocking .env reads and validating .squad commits.

Updated Jan 5, 2026
Search Tags:#pre-commit#team-collaboration#secret-management#security-policy#code-security#env-files#credential-leak
One-click install
npx skills add https://github.com/Golnaz89/golnaz89.github.io --skill secret-handling-golnaz89
Or copy as Structured Prompt for Agentβ–Ό
Please help me install this Agent Skill.
Skill: secret-handling
Source: https://github.com/Golnaz89/golnaz89.github.io/tree/main/.copilot/skills/secret-handling
Command: npx skills add https://github.com/Golnaz89/golnaz89.github.io --skill secret-handling-golnaz89

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Spawned agents have read access to the entire repository, including the environment files containing live credentials. This Skill codifies absolute prohibitions and safe alternatives to prevent credential leakage into .squad/ generated decisions, logs, and history.

Core Features & Use Cases

  • Prohibited File Reads: NEVER read these files: .env (production secrets), .env.local (local dev secrets), .env.production (production environment), .env.development (development environment), .env.staging (staging environment), .env.test (test environment with real credentials), and any file matching .env.* unless explicitly allowed.
  • Allowed alternatives: .env.example, .env.sample, .env.template.
  • If you need config info: 1) Ask the user directly β€” β€œWhat’s the database connection string?”, 2) Read .env.example β€” shows structure without exposing secrets, 3) Read documentation β€” check README.md, docs/, config guides.
  • NEVER assume you can just peek at .env to understand the schema. Use .env.example or ask.
  • Scribe Pre-Commit Validation: Before committing .squad changes, Scribe MUST 1) Scan all staged files for secret patterns, 2) Check for prohibited file names, 3) If secrets detected: STOP the commit and report, 4) If no secrets detected: proceed with commit.
  • Remediation β€” If a Secret Was Already Committed: 1) STOP immediately, 2) Alert the user with guidance, 3) Do NOT attempt to fix it yourself, 4) Wait for user confirmation before resuming work.
  • Examples: βœ“ Correct: Reading Config Schema; βœ— Incorrect: Reading Live Credentials; βœ“ Correct: Scribe Pre-Commit Validation.

Quick Start

Tell the agent to never read live environment files and to consult .env.example for schema before attempting to read.

Frequently Asked Questions about secret-handling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent AI agents from reading .env files and leaking credentials into logs?β–Ό

Prevent credential leakage by forbidding agents from reading live environment files like .env and .env.production. Direct agents to read .env.example for schema or ask the user directly for configuration details to keep secrets out of generated logs.

What is the safe alternative to reading .env files for understanding configuration schema?β–Ό

The safe alternative to reading .env files is checking .env.example, .env.sample, or .env.template. These show the configuration structure without exposing live credentials, and you can also consult README.md or ask the user directly for needed config info.

How do I validate staged files for secret patterns before a pre-commit?β–Ό

Run pre-commit validation by scanning all staged files for secret patterns and checking for prohibited file names. If secrets are detected, stop the commit and report; if no secrets are detected, proceed with committing the changes safely.

What should I do if a secret was already committed to the repository?β–Ό

If a secret was already committed, stop work immediately and alert the user with remediation guidance. Do not attempt to fix the leak yourself, and wait for explicit user confirmation before resuming any repository work.

Can I use this secret-handling approach for team collaboration across staging and development environments?β–Ό

Yes, this approach applies when accessing repositories containing .env files across staging, development, and production environments. It enforces safe handling by blocking reads of all environment-specific files and requiring explicit prompts to obtain config details.

Related Skills

Explore More Software Engineering Skills→
quaid-appquaid-app
3

secret-handling

Enforce secret-handling policies that prohibit reading live credential files.

Official
Advanced
nicolehaugennicolehaugen

secret-handling

Block commits containing secret patterns using Scribe pre-commit validation.

Community
Advanced
truongnattruongnat
1

review-pr

Review pull requests for code quality, security, and compliance.

Community
Advanced
4lerman4lerman

env-secrets-manager

Audit repositories for sensitive data and manage environment variables securely.

Community
Advanced