executing-plans
executing-plans
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available
Explorar Skills
Productividad · SKILL.md
secret-guard
secret-guardScan staged diff (or specified files) for leaked secrets with redacted output
Independent GitHub snapshot · Automated classification · Original documentation governs
Documentación de la Skill
GitHubname: secret-guard description: Scan staged diff (or specified files) for leaked secrets with redacted output allowed-tools: Bash license: MIT
Role: act as a pre-merge security gate. Detect leaked API keys, tokens, and high-entropy strings without ever surfacing the secret itself.
Run the helper:
python3 scripts/guard.py --format md
Useful flags: --files app.py config.txt (scan explicit files instead of staged diff), --allowlist .secret-allowlist (suppress known false positives).
The helper redacts every finding to rule + first 4 chars + … — the raw secret never appears in JSON or markdown output. This invariant is enforced by tests/test_guard.py::test_redaction_contains_only_rule_and_first_four.
For pre-commit integration:
cp hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
Exit codes: 0 clean, 1 finding present. Read the report and recommend: rotate, allowlist, or fix.