Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

Commencer

secret-hygiene

Étoiles1

Forks0

Mis à jour24 avril 2026 à 14:49

Practical rules for keeping API keys, PATs, and signed request material out of the repo, logs, and artifacts.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

strmt7

strmt7/simple_ai_trading

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	secret-hygiene
description	Practical rules for keeping API keys, PATs, and signed request material out of the repo, logs, and artifacts.
origin	repo-local skill inspired by ZMB-UZH/omero-docker-extended env-contract-reviewer

Secret Hygiene

Use this skill any time secrets enter the session — user-supplied API keys, Git PATs, environment variables, or captured HTTP samples.

Channels that must stay clean

Commit history: no API keys, no PATs, no signed URLs. A committed secret must be rotated, not just reverted.
Runtime logs (stdout, stderr, the TUI activity panel): all outgoing URLs flow through _redact_request_url before display.
Artifacts under data/: persisted JSON uses RuntimeConfig.public_dict() for any embedded runtime snapshot.
Tests: fixtures use obviously-fake values ("fake-api-key", "fake-secret"). Never commit real testnet credentials even if they are "only" testnet.

Workflow for user-supplied credentials

User provides a PAT or API key for a one-off operation.
Read it via getpass.getpass or from an env var you control. Do not splice it into argv or subprocess command lines.
When you hand it to Git, use the credential helper stub in tools/push_with_pat.py — the PAT is served over a socket to a scoped GIT_ASKPASS, never written to a file, remote URL, or credential.helper.
After the operation, git remote -v should not contain the PAT. ~/.git-credentials should not exist (or should not mention github.com with the PAT).
If the PAT was pasted into the conversation, treat it as compromised the moment the task completes — tell the user to rotate it.

Env-var overrides

BINANCE_BASE_URL, BINANCE_SPOT_BASE_URL, BINANCE_FUTURES_BASE_URL are advertised overrides. Any new env var you read:

Has a matching .env.example entry.
Is documented in the README Host overrides section.
Is trimmed (.strip()) and treated as untrusted input.

Quick self-check before committing

git diff --cached | grep -EiI 'ghp_|ghs_|github_pat_|AKIA|sk-[A-Za-z0-9]{20,}|-----BEGIN .* PRIVATE KEY-----'
git diff --cached | grep -E 'api_key|api_secret' | grep -v '<redacted>\|fake-\|BLANK'

A hit on either grep is a blocker.

Plus depuis ce dépôt

même dépôt

cocoindex-code-search

strmt7/simple_ai_trading

Use the pinned external CocoIndex Code MCP workflow for broad repository routing, then prove exact candidates with rg and direct file reads.

2026-07-151

context-budget

strmt7/simple_ai_trading

Bound repository context reads and semantic-search output without weakening source, test, or evidence verification.

2026-07-151

ai-regression-testing

strmt7/simple_ai_trading

Choose staged contract tests that catch partial AI-generated fixes across models, data, risk, execution ownership, and CLI/Windows parity.

2026-07-111

docs-knowledge-maintainer

strmt7/simple_ai_trading

Keep concise user docs and machine-readable model evidence synchronized with real behavior without losing provenance or caveats.

2026-07-111

karpathy-guidelines

strmt7/simple_ai_trading

Apply four anti-error coding principles plus this repository's stricter financial-evidence, safety, and single-session rules.

2026-07-111

search-first

strmt7/simple_ai_trading

Research the existing implementation, tests, primary technical sources, and financial rationale before adding trading code or dependencies.

2026-07-111

Secret Hygiene

Use this skill any time secrets enter the session — user-supplied API keys, Git PATs, environment variables, or captured HTTP samples.

Channels that must stay clean

Commit history: no API keys, no PATs, no signed URLs. A committed secret must be rotated, not just reverted.

Runtime logs (stdout, stderr, the TUI activity panel): all outgoing URLs flow through _redact_request_url before display.

Artifacts under data/: persisted JSON uses RuntimeConfig.public_dict() for any embedded runtime snapshot.

Tests: fixtures use obviously-fake values ("fake-api-key", "fake-secret"). Never commit real testnet credentials even if they are "only" testnet.

Workflow for user-supplied credentials

User provides a PAT or API key for a one-off operation.

Read it via getpass.getpass or from an env var you control. Do not splice it into argv or subprocess command lines.

When you hand it to Git, use the credential helper stub in tools/push_with_pat.py — the PAT is served over a socket to a scoped GIT_ASKPASS, never written to a file, remote URL, or credential.helper.

After the operation, git remote -v should not contain the PAT. ~/.git-credentials should not exist (or should not mention github.com with the PAT).

If the PAT was pasted into the conversation, treat it as compromised the moment the task completes — tell the user to rotate it.

Env-var overrides

BINANCE_BASE_URL, BINANCE_SPOT_BASE_URL, BINANCE_FUTURES_BASE_URL are advertised overrides. Any new env var you read:

Has a matching .env.example entry.

Is documented in the README Host overrides section.

Is trimmed (.strip()) and treated as untrusted input.

Quick self-check before committing

git diff --cached | grep -EiI 'ghp_|ghs_|github_pat_|AKIA|sk-[A-Za-z0-9]{20,}|-----BEGIN .* PRIVATE KEY-----' git diff --cached | grep -E 'api_key|api_secret' | grep -v '<redacted>\|fake-\|BLANK'

A hit on either grep is a blocker.