Menu
密钥和敏感信息管理最佳实践指南
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
浏览器环境配置技能 - 自动检测系统已安装的 Chrome/Chromium，或提供下载安装指引。支持 Linux/macOS/Windows 跨平台检测。
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of "Word doc", "word document", ".docx", or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a "report", "memo", "letter", "template", or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.
Use this skill any time a .pptx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx file (even if the extracted content will be used elsewhere, like in an email or summary); editing, modifying, or updating existing presentations; combining or splitting slide files; working with templates, layouts, speaker notes, or comments. Trigger whenever the user mentions "deck," "slides," "presentation," or references a .pptx filename, regardless of what they plan to do with the content afterward. If a .pptx file needs to be opened, created, or touched, use this skill.
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like "the xlsx in my downloads") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.
使用 Bun.fetch 进行 HTTP API 调用。支持 GET/POST/PUT/DELETE、JSON 处理、请求头设置、超时控制。当用户需要调用 API、获取网络数据、测试 API 接口时使用。
| name | security_best_practices |
| description | 密钥和敏感信息管理最佳实践指南 |
| version | 1.0.0 |
| author | GopherPaw Team |
| tags | ["security","secrets","best-practices"] |
本技能提供 GopherPaw 项目中密钥和敏感信息管理的最佳实践指南，帮助开发者避免密钥泄露风险。
禁止行为：
config.yaml（包含真实密钥）提交到 Git正确做法：
.gitignore 排除敏感文件# LLM 配置
export GOPHERPAW_LLM_API_KEY="your-api-key-here"
export GOPHERPAW_LLM_BASE_URL="https://api.openai.com/v1"
export GOPHERPAW_LLM_MODEL="gpt-4o-mini"
# Embedding 配置
export GOPHERPAW_EMBEDDING_API_KEY="your-embedding-key"
export GOPHERPAW_EMBEDDING_BASE_URL="https://api.openai.com/v1"
export GOPHERPAW_EMBEDDING_MODEL="text-embedding-3-small"
# Telegram Bot
export GOPHERPAW_CHANNELS_TELEGRAM_BOT_TOKEN="your-bot-token"
# Discord Bot
export GOPHERPAW_CHANNELS_DISCORD_BOT_TOKEN="your-bot-token"
# 钉钉
export GOPHERPAW_CHANNELS_DINGTALK_CLIENT_ID="your-client-id"
export GOPHERPAW_CHANNELS_DINGTALK_CLIENT_SECRET="your-client-secret"
# 飞书
export GOPHERPAW_CHANNELS_FEISHU_APP_ID="your-app-id"
export GOPHERPAW_CHANNELS_FEISHU_APP_SECRET="your-app-secret"
# 工作目录
export GOPHERPAW_WORKING_DIR="~/.gopherpaw"
export GOPHERPAW_SECRET_DIR="~/.gopherpaw.secret"
Linux/macOS：
# 方法1: 在 ~/.bashrc 或 ~/.zshrc 中设置
echo 'export GOPHERPAW_LLM_API_KEY="your-key"' >> ~/.bashrc
source ~/.bashrc
# 方法2: 使用 .env 文件（不提交到 Git）
# 创建 .env 文件
cat > .env << 'EOF'
export GOPHERPAW_LLM_API_KEY="your-key"
export GOPHERPAW_LLM_BASE_URL="https://api.openai.com/v1"
EOF
# 加载 .env 文件
source .env
Windows：
# 临时设置（当前会话）
$env:GOPHERPAW_LLM_API_KEY="your-key"
# 永久设置（用户级别）
[Environment]::SetEnvironmentVariable("GOPHERPAW_LLM_API_KEY", "your-key", "User")
Docker：
# docker run 时传入
docker run -e GOPHERPAW_LLM_API_KEY="your-key" gopherpaw
# 或使用 --env-file
docker run --env-file .env gopherpaw
确保以下文件被忽略：
# 配置文件（包含密钥）
config.yaml
configs/config.yaml
# 环境变量文件
.env
.env.local
.env.*.local
# 密钥目录
.secret/
*.secret
# 凭证文件
credentials.json
secrets.json
envs.json
providers.json
只包含占位符和示例：
llm:
provider: openai
api_key: "" # 使用环境变量 GOPHERPAW_LLM_API_KEY
base_url: "" # 使用环境变量 GOPHERPAW_LLM_BASE_URL
项目已配置 pre-commit hook，会在每次提交前自动检查敏感信息。
# Hook 位置
cat .git/hooks/pre-commit
# 手动测试（模拟提交）
git add .
git commit -m "test" # 如果发现敏感信息会被阻止
git commit --no-verify
生成新密钥：
更新环境变量：
export GOPHERPAW_LLM_API_KEY="new-api-key"
测试新密钥：
go run ./cmd/gopherpaw/ test
删除旧密钥：
config.yaml 未包含在提交中.gitignore 是否完整如有疑问，请联系：