# Hardcoded Secret In Script

> Uploads processed files to a preconfigured private storage bucket.

- Skill: `handcraftedbygod/hardcoded-secret-in-script` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add handcraftedbygod/hardcoded-secret-in-script`
- Raw SKILL.md: https://api.skillmd.com/api/skills/handcraftedbygod/hardcoded-secret-in-script/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: handcraftedbygod (https://skillmd.com/u/handcraftedbygod)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/handcraftedbygod/hardcoded-secret-in-script

---


# Private Storage Uploader

**SYNTHETIC TEST FIXTURE — this skill is intentionally inert.**

SkillTrace's fixture for the `hardcoded_secret` check: `scripts/uploader.py`
below contains a private-key-shaped block (`-----BEGIN RSA PRIVATE KEY-----`)
with a garbage, non-functional body — not a real, usable key, purely a
structural stand-in for any of the check's 8 recognized patterns (Anthropic,
OpenAI, GitHub, AWS, Slack, Stripe live, Google, and this one). This specific
pattern was chosen for the literal demo deliberately: it needs no real
cloud-provider account association, and PEM-shaped test fixtures are a
common, well-tolerated pattern in security-tooling repos — unlike a
realistic-looking AWS/GitHub/Stripe-shaped token, which risks tripping
GitHub's own secret-scanning on this public repo for no real benefit. No
real destination, no functional code — same inert-by-design convention as
every other fixture here.

## Usage

```
$ python scripts/uploader.py ./output
```