agentsclimarketplace
Sign in

Secret hygiene

Skill 26zl/universal-agent-skills/skills/secret-hygiene

Never write, echo, or commit secret values such as API keys, tokens, passwords, or private keys; reference them through environment variables or a secret manager, and report discovered secrets without reproducing the value. Use when writing code, tests, configuration, documentation, logs, or shell commands that touch credentials; do not use to weaken cryptographic material handling that the product itself must perform.From its SKILL.md

Install
npx -y skills add 26zl/universal-agent-skills --skill secret-hygiene

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.7 KB, 244 tokens by cl100k_base, as published. Nobody here has run it

Secret Hygiene

A secret that enters code, output, or history must be treated as leaked.

Rules

  • Never hardcode API keys, tokens, passwords, connection strings, or private keys in code, tests, fixtures, configuration, or documentation examples; reference environment variables or the project's secret manager and document the variable name only.
  • Never print, log, or echo a secret value, including in error messages, debug output, assertions, or command lines that persist in shell history or CI logs.
  • Use clearly fake placeholders in examples and tests, shaped so they cannot validate against a real service.
  • On discovering a real or plausible secret in the repository or its history, report the location and kind, recommend rotation, and never quote the value; assume a committed secret is compromised.
  • Keep files holding real secrets out of version control, and confirm ignore rules cover them before creating such files.
  • Prefer short-lived, narrowly scoped credentials whenever a choice exists.

Boundaries

  • Do not delete or rewrite committed secrets unprompted; rotation and history cleanup are decisions for the owner.
  • Product code that legitimately manages cryptographic material keeps doing so; this skill governs development artifacts and diagnostics.

What ships with it: 1 file

195 B alongside SKILL.md

agents/

Gives 0 of the 12 instructions most docs writing skills give in 244 tokens

Counted across 1,951 of the 3,904 authors here whose files we hold, read 2026-09-06

  • Use third-person for skill descriptionsin 54 of 1951, across 35 files
  • Start descriptions with Use whenin 43 of 1951, across 29 files
  • Run baseline scenarios before writing any skillin 40 of 1951, across 26 files
  • Use active voicein 40 of 1951, across 36 files
  • Map file responsibilities before defining tasksin 36 of 1951, across 29 files
  • Use checkbox syntax for tracking stepsin 35 of 1951, across 27 files
  • Ask one question at a timein 35 of 1951
  • Offer execution options after saving the planin 33 of 1951, across 24 files
  • Include complete code in every stepin 33 of 1951, across 27 files
  • Design units with clear boundaries and interfacesin 31 of 1951, across 23 files
  • Announce the skill usage at the startin 30 of 1951
  • Verify agent compliance after adding the skillin 29 of 1951, across 17 files

Said here and by no other author read

  • Use fake placeholders in examples and tests
  • Report location and kind of discovered secrets
  • Recommend rotation for discovered secrets
  • Keep secret files out of version control
  • Confirm ignore rules cover secret files
  • Prefer short-lived and scoped credentials

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.