gabrielmoreira Secrets Handling Review
Core Workflow
- Identify any credentials, tokens, keys, cookies, env vars, config files, or secret-like placeholders mentioned by the skill.
- Check whether the skill asks to read, print, store, transmit, log, or commit secrets.
- Review scripts and examples for accidental secret exposure in output, screenshots, generated files, traces, or error reports.
- Verify redaction, least privilege, and explicit approval expectations.
- Recommend removal, placeholder replacement, redaction rules,
.gitignoreupdates, or blocked publication. - Report residual risk and safe-use instructions.
Safety Rules
- Do not reveal secret values in review output.
- Do not commit secrets or secret-like sample values.
- Do not approve a skill that asks for broad credential access unrelated to the task.
- Prefer placeholders and user-managed environment setup over embedded secrets.
Deliverable Shape
For secrets reviews, provide:
- Secret-like inputs found
- Exposure paths
- Redaction and storage gaps
- Required changes
- Safe handling instructions
- Pass/warn/fail/block recommendation
References
- Read
references/secrets-handling-review-checklist.mdwhen reviewing skills, scripts, examples, logs, templates, or generated files for secrets risk.