Auto skill safety mcp secret guard

Skill Arnie016/codex-prompt-templates/skills/auto-skill-safety-mcp-secret-guard

Color-coded Codex prompt templates and Agent Skills for plugin-orchestrated AI coding workflows, MCP safety, repo intelligence, and automation.

Install

npx -y skills add Arnie016/codex-prompt-templates --skill auto-skill-safety-mcp-secret-guard

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Prevent secret leakage when adding or reviewing MCP server configs. Use when you see `mcpServers` JSON, `.env`, config snippets, tool docs, or logs that might contain API keys/tokens. Produces a redacted config + a short secret hygiene report.

SKILL.md

2.0 KB, as published. Nobody here has run it

MCP Secret Guard (Config Hygiene)

Generated by: Codex Supercharge maintenance automation.

Goal: keep credentials out of repos, prompts, and MCP config files while still producing a usable config snippet.

Trigger

You are adding/editing MCP config (e.g., mcpServers JSON).
A repo/README shows tokens/keys in examples.
Logs or screenshots may include secrets.

Workflow

Identify config surfaces
- Search for likely MCP config locations:
  - rg -n \"\\bmcpServers\\b\" -S --hidden .
  - rg -n \"mcp\" -S --hidden .codex* ~/.codex 2>/dev/null || true
Detect secret-shaped strings (local only)
- Run conservative scans (don’t paste results into chat unredacted):
  - rg -n \"(api[_-]?key|access[_-]?token|secret|private[_-]?key|bearer)\" -S --hidden .
  - rg -n \"sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}\" -S --hidden .
Normalize config to env-var references
- Replace inline secrets with env-var placeholders:
  - Prefer "env": { \"API_KEY\": \"${API_KEY}\" } style.
  - Never commit .env; add to .gitignore if needed.
Redact before sharing
- Any time you must include an example, redact to:
  - ***REDACTED*** or ${ENV_VAR} (never partial key fragments).
Record where secrets should live
- OS keychain / password manager / CI secret store.
- Minimal env var list required to run.

Output

# MCP Secret Hygiene Report
Config files checked:
Findings (redacted):
Required env vars:
Redaction actions taken:
Remaining risks:

Skip When

You are only reviewing high-level architecture and no configs/logs are involved.

Validation

Re-run the scans in step 2 after edits; expect 0 inline secrets in tracked files.