What problem does it solve?
Spawned agents have read access to the entire repository, including .env files containing live credentials. This skill codifies absolute prohibitions and safe alternatives to prevent credentials from being read or written to committed files.
Core Features & Use Cases
- Prohibited File Reads: NEVER read these files:
.env (production secrets).env.local (local dev secrets).env.production (production environment).env.development (development environment).env.staging (staging environment).env.test (test environment with real credentials)- Any file matching
.env.* UNLESS explicitly allowed (see below)
- Allowed alternatives:
.env.example (safe — contains placeholder values, no real secrets).env.sample (safe — documentation template).env.template (safe — schema/structure reference)
- If you need config info:
- Ask the user directly — "What's the database connection string?"
- Read
.env.example — shows structure without exposing secrets
- Read documentation — check
README.md, docs/, config guides
- NEVER assume you can "just peek at .env to understand the schema." Use
.env.example or ask.
- NEVER write secrets to
.squad/ files
- See prohibited output patterns and examples
- Scribe Pre-Commit Validation: Scan staged files for secret patterns before commit; block if detected, and report to user.
- Remediation & Guardrails:
- If a secret was already committed, stop, alert, rotate credentials, and clean history.
Quick Start
Configure the agent to never read live secrets and to reference safe placeholders (like .env.example) for configuration schema.
