auto-skill-safety-mcp-secret-guard

name	auto-skill-safety-mcp-secret-guard
description	Prevent secret leakage when adding or reviewing MCP server configs. Use when you see `mcpServers` JSON, `.env`, config snippets, tool docs, or logs that might contain API keys/tokens. Produces a redacted config + a short secret hygiene report.

MCP Secret Guard (Config Hygiene)

Generated by: Codex Supercharge maintenance automation.

Goal: keep credentials out of repos, prompts, and MCP config files while still producing a usable config snippet.

Trigger

• You are adding/editing MCP config (e.g., mcpServers JSON).
• A repo/README shows tokens/keys in examples.
• Logs or screenshots may include secrets.

Workflow

1. Identify config surfaces
   • Search for likely MCP config locations:
     • rg -n \"\\bmcpServers\\b\" -S --hidden .
     • rg -n \"mcp\" -S --hidden .codex* ~/.codex 2>/dev/null || true
2. Detect secret-shaped strings (local only)
   • Run conservative scans (don’t paste results into chat unredacted):
     • rg -n \"(api[_-]?key|access[_-]?token|secret|private[_-]?key|bearer)\" -S --hidden .
     • rg -n \"sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}\" -S --hidden .
3. Normalize config to env-var references
   • Replace inline secrets with env-var placeholders:
     • Prefer "env": { \"API_KEY\": \"${API_KEY}\" } style.
     • Never commit .env; add to .gitignore if needed.
4. Redact before sharing
   • Any time you must include an example, redact to:
     • ***REDACTED*** or ${ENV_VAR} (never partial key fragments).
5. Record where secrets should live
   • OS keychain / password manager / CI secret store.
   • Minimal env var list required to run.

Output

# MCP Secret Hygiene Report
Config files checked:
Findings (redacted):
Required env vars:
Redaction actions taken:
Remaining risks:

Skip When

• You are only reviewing high-level architecture and no configs/logs are involved.

Validation

• Re-run the scans in step 2 after edits; expect 0 inline secrets in tracked files.