Redgvng

Audit env vars for a project — detects missing variables before `npm run dev`/`python ./run.py` crashes 30s later. Cross-checks .env vs .env.example vs code references (process.env.X, import.meta.env.X, os.getenv, os.environ). Tracks unused declarations and undocumented vars. Generates .env.example template from code. Use when starting work on a fresh clone, before deployment, or when a 'X is not defined' runtime error appears. Calls the env-doctor MCP.

Patterns and conventions for building new MCP servers in CommandCode (Python FastMCP, stdio transport, ~/.commandcode/mcp-servers/). Covers boilerplate, tool design, schema parsing, guardrails (denylist/dryRun/audit), handshake testing, registration in mcp.json, and the central rule: do NOT MCP-ify mature CLI tools (NIH trap). Use when the user asks to create a new MCP, refactor an existing one, or evaluate whether a feature should be MCP/skill/script.

Detect leaked secrets in git diffs, history, or single files. Hybrid mode: wraps gitleaks if installed (battle-tested rules), falls back to 16 builtin regex patterns covering AWS/GitHub/Stripe/OpenAI/Anthropic/JWT/PEM keys/nvapi/Mistral. Use BEFORE every commit, when reviewing a PR, or when auditing a repo for past leaks. Output is masked (last 4 chars only) — never prints the full secret. Calls the secret-scan MCP.

Use when asked to find exploits, run a deep vuln audit, "run mythos", build exploit chains, or produce PoC-confirmed security findings on a codebase. Triggers on: "find CVE-grade bugs", "audit for RCE/privesc", "security research", "exploit chain", CTF binary analysis, memory-safety audit (C/C++/Rust/Go), or any request requiring machine-readable vuln output beyond static OWASP grep. For quick OWASP surface scan use security-audit skill instead.