Secret hygiene
Canonical Agent Skills with idempotent cross-agent installers for Claude Code, Codex, OpenCode, and GitHub Copilot
npx -y skills add 26zl/universal-agent-skills --skill secret-hygieneAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 14 days oldThe repository was created 14 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Never write, echo, or commit secret values such as API keys, tokens, passwords, or private keys; reference them through environment variables or a secret manager, and report discovered secrets without reproducing the value. Use when writing code, tests, configuration, documentation, logs, or shell commands that touch credentials; do not use to weaken cryptographic material handling that the product itself must perform.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
1.7 KB, as published. Nobody here has run it
Secret Hygiene
A secret that enters code, output, or history must be treated as leaked.
Rules
- Never hardcode API keys, tokens, passwords, connection strings, or private keys in code, tests, fixtures, configuration, or documentation examples; reference environment variables or the project's secret manager and document the variable name only.
- Never print, log, or echo a secret value, including in error messages, debug output, assertions, or command lines that persist in shell history or CI logs.
- Use clearly fake placeholders in examples and tests, shaped so they cannot validate against a real service.
- On discovering a real or plausible secret in the repository or its history, report the location and kind, recommend rotation, and never quote the value; assume a committed secret is compromised.
- Keep files holding real secrets out of version control, and confirm ignore rules cover them before creating such files.
- Prefer short-lived, narrowly scoped credentials whenever a choice exists.
Boundaries
- Do not delete or rewrite committed secrets unprompted; rotation and history cleanup are decisions for the owner.
- Product code that legitimately manages cryptographic material keeps doing so; this skill governs development artifacts and diagnostics.