Menu
Enforce safe handling of API keys, tokens, passwords, and any other secret in the project. Run when adding integrations, before commits, or when the user pastes a value that looks like a credential.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Plan post-first-100-users growth without burning out the founder, the budget, or the user base. Pairs with `first-100-users` (which gets you to 100); this skill takes you from 100 to ~1000 sustainably. Activated when the user says "já tenho 100 usuários, e agora?", "como cresço sem queimar dinheiro?", "o WhatsApp 1-a-1 não escala mais".
Get a second (and third) AI opinion on hard-to-reverse decisions. Runs the same prompt through different agent roles or model families in parallel, then reconciles disagreements. Inspired by gstack's `/codex` cross-review pattern. Activated for architecture decisions, security-sensitive code, pricing/packaging changes, deploy gates, legal-adjacent text, or any decision the user flags as "não dá pra desfazer fácil".
Turn a manually-validated workflow into a documented, repeatable, and partially-automatable process. Use AFTER a task has been done at least 3 times by hand and is showing signs of repetition. Inspired by Sahil Lavingia's principle "do it manually until it works, then processize." Activated when the user says "tô fazendo isso toda semana", "vamos automatizar?", "isso já cansou", or after `daily-standup` flags repeated manual work.
Recommend external repo packs from docs/registry/ that fit a project's stack, domain, and constraints. Use during /project-start (after the Technical Plan), when the user asks "que repos eu deveria usar?", or whenever a new need (security review, design system, deploy guidance) appears mid-build.
Flag potentially expensive technical choices BEFORE they are committed. Watch for AI model selection, hosting tier upgrades, third-party services with metered pricing, and DB patterns that explode with scale.
At the start of a session (or on user request "o que a gente fez", "onde paramos"), produce a 4-bullet briefing — what's done, what's in progress, what's next, what's blocked. Replaces the dev habit of standup for solo vibe coders.
| name | secrets-discipline |
| description | Enforce safe handling of API keys, tokens, passwords, and any other secret in the project. Run when adding integrations, before commits, or when the user pastes a value that looks like a credential. |
sk_, pk_, re_, etc.).= followed by a long opaque string.process.env.X (or framework equivalent)..env.example when introducing a new env var. The example file documents the existence of the variable, not its value..env, .env.local, .env.production. They are gitignored — verify before commit.NEXT_PUBLIC_ is shipped to the browser. If it's a secret, do NOT prefix it.Secrets are like the keys to your house. The
.envfile is the keychain you keep at home. The.env.exampleis the description of what keys you need (front door, garage, mailbox) without showing what they look like. When you share your project on GitHub, you share the description — never the actual keys.
process.env.X (or equivalent)..env.example documents each new variable with a comment explaining purpose..env, .env.local are in .gitignore.sk_[a-zA-Z0-9]{20,}, pk_[a-zA-Z0-9]{20,}, re_[a-zA-Z0-9]{20,}, AIza[a-zA-Z0-9\-_]{35}).✅ secrets-discipline check
- New variables documented in .env.example: STRIPE_WEBHOOK_SECRET
- No literal secrets in source code
- .gitignore covers .env files
- Server-only vars not exposed via NEXT_PUBLIC_
⚠️ If you committed a real key earlier, rotate it now in the provider dashboard.