What problem does it solve? Test suites often accumulate hardcoded secrets — passwords, API keys, JWTs, real-looking emails, and app URLs — that leak into version control and break portability across environments. This Skill sweeps the test tree for those literals and replaces them with environment variables before the suite is published or shared. ## Core Features & Use Cases - Pattern-based secret detection: Greps the test tree for credential keywords, token shapes (JWTs, AWS keys, GitHub/Slack tokens), email addresses, and URL/port literals, with explicit handling of false positives. - Structured remediation: Replaces literals with process.env references, writes a gitignored .env with real values, a committed .env.example with placeholders, and verifies .gitignore coverage including .env.local variants. - Verification and reporting: Re-scans after remediation, runs the Playwright suite to confirm nothing broke, and returns a schema-conformant handover with status, env var names, and files modified. - Use Case: Before open-sourcing a Playwright E2E suite, run the sweep to extract a hardcoded Stripe test key and localhost URL into STRIPE_API_KEY and APP_URL, leaving the suite green and safe to publish. ## Quick Start Sweep my Playwright test suite for hardcoded secrets and extract them into .env before I publish it.
