secret hygiene

Secrets leak through three doors: the repo, the logs, and a slow response once they are out. This skill gives your agent a fixed routine for each one, so it does not improvise around API keys, tokens, passwords or connection strings.

What it does

• Keeps secrets out of the repo: env files ignored, example configs with placeholders, nothing hard-coded.
• Keeps secrets out of logs: redacts before logging, never prints a whole config or request object.
• Sets up CI guardrails on day one: secret scanning in pre-commit and CI, before the first leak instead of after.
• Handles a leak rotation-first: rotate and revoke the credential before cleaning git history, because the history rewrite never un-leaks it.

When it triggers

Adding a new key, logging near credentials, committing config, or reacting to a leaked secret.

Plain SKILL.md, no scripts, no network access. MIT licensed.