Skip to main content Skills Marketplace 커뮤니티가 만든 AI 스킬을 발견하고 탐색하세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/domehahn/skil --skill secrets-reviewer명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Zip 다운로드 다운로드 중... name secrets-reviewer description Describe what this skill helps an agent do. version 0.1.0 since 2026-07-28 last_modified 2026-07-28 authors ["platform-engineering"] stability experimental min_platform_version {"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"} deprecated_since null replaces null supersedes [] changelog [{"version":"0.1.0","date":"2026-07-28","change":"Initial generated production-ready SDLC / DevSecOps skill"}]
Secrets Reviewer
Purpose
Identify and handle secrets, credentials, tokens, private keys, passwords, .env files, CI variables, config files, logs, fixtures, database dumps, rotation, revocation, scanning, and false positives.
When to use
A change adds or modifies credentials, tokens, config, logs, CI variables, fixtures, dumps, or secret references.
A suspected secret exposure needs triage without printing secret values.
Secret storage, rotation, revocation, scope, or ownership is unclear.
CI/CD, examples, docs, or tests may leak sensitive values.
The central agent routes to secrets review.
Operating model
Inspect likely secret locations while redacting values in output.
Classify each candidate as real secret, placeholder, test fixture, public identifier, or unknown.
Assess exposure path: repository content, history, logs, artifacts, CI, docs, images, or dumps.
Recommend containment: remove, rotate, revoke, scope down, and prevent recurrence.
Report only fingerprints, paths, and safe excerpts.
Spec-Driven Change Context
Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
Capture requirement deltas explicitly: added, modified, removed, deprecated, or unchanged behavior.
Keep implementation tasks traceable to acceptance criteria, affected specs, validation commands, and owners.
During verification, compare the implementation against the proposal, design decisions, task checklist, and spec deltas.
After completion, sync or archive completed change artifacts so the repository's source of truth reflects the final behavior.
If the repository has no spec workflow yet, report the missing artifact and provide a minimal proposal/spec/tasks outline instead of relying on chat-only intent.
Skill-Specific Review Scope
API keys, tokens, private keys, passwords, .env files, and CI variables.
Config files, logs, fixtures, artifacts, database dumps, and history exposure.
Secret storage, rotation, revocation, scope, and owners.
Secret scanning, false positives, prevention controls, and follow-up actions.
Output redaction and safe handling of suspected values.
Skill-Specific Checklist
.env, sample env files, config maps, secrets manifests, and local setup docs.
Decision Rules
If a value could authenticate to a real system, treat it as a secret until proven otherwise.
If a secret reached git history, logs, artifacts, package images, or third-party systems, require rotation and revocation.
If a token is broad-scope, long-lived, or production-scoped, raise severity.
If examples need credentials, use obvious fake placeholders and setup instructions.
If output would reveal a secret, redact all but a short fingerprint.
If ownership is unclear, require owner identification before closure.
Finding Categories
Hardcoded credential, token, private key, password, or connection string.
Secret leakage through logs, artifacts, screenshots, fixtures, dumps, or generated files.
Unsafe CI/CD secret scope, masking, debug output, or environment exposure.
Missing rotation, revocation, owner, expiry, or scope reduction.
False positive or placeholder requiring safe classification.
Secret prevention gap in scanning, hooks, docs, or review process.
Severity Guidance
Critical: immediate exploitability or operational failure can expose secrets, regulated data, production safety, or release integrity.
High: credible security, reliability, compliance, rollback, or user-impact risk requires owner action before merge or release.
Medium: meaningful maintainability, validation, documentation, or process gap should be tracked and resolved.
Low: advisory improvement, clarity issue, or hardening opportunity with limited immediate impact.
DevSecOps Guardrails
Do not read secrets, .env files, private keys, production credentials, masked CI/CD variables, database dumps, or sensitive logs unless explicitly required.
Do not push, deploy, publish, merge, or create releases unless explicitly asked.
Prefer merge requests, reviewable diffs, and auditable validation evidence.
Prefer least privilege, minimal changes, and explicit rollback notes.
Do not fabricate test results, repository state, commands, security findings, or validation outcomes.
Report assumptions, uncertainty, residual risk, and validation gaps clearly.
Output Requirements
Redacted findings with path, line/context, secret type, confidence, and fingerprint.
Exposure assessment covering repository, history, logs, artifacts, CI, docs, and packages.
Rotation, revocation, removal, and prevention steps with owners.
False-positive list with safe rationale.
Validation commands or scanning evidence used.
Residual risk and whether release or merge should be blocked.
Acceptance Criteria
No full secret value is printed in output.
Real or likely real secrets have rotation and revocation guidance.
Exposure paths and blast radius are assessed.
False positives are justified without unsafe disclosure.
Prevention controls are recommended for recurring classes.
Release recommendation reflects secret severity and containment state.
Anti-Patterns
Printing full credentials to prove a finding.
Dismissing tokens as test data without evidence.
Removing a secret from the current file while ignoring git history, logs, or artifacts.
Rotating without revoking old credentials.
Using production-looking examples in documentation.
Treating masked CI variables as safe when debug output or artifacts expose them.
Changelog
0.1.0 - 2026-07-28
Initial generated production-ready SDLC / DevSecOps skill.
