菜单
Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks, or run secleak-check before release.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Find, clone, inspect, and summarize high-quality GitHub reference repositories for coding agents. Use when a user asks for GitHub reference projects, examples, prior art, inspiration, implementation patterns, or includes "$search-context" in a coding prompt.
Live-test any Electron desktop app with native-devtools-mcp, Chrome DevTools Protocol, screenshots, OCR, and accessibility tools. Use when the user asks for Electron UI verification, MCP-driven app control, renderer CDP interaction, native desktop automation, screenshots, or OCR-driven checks.
Use this skill when the user wants to turn an application, product, startup idea, SaaS, mobile app, web app, API, AI product, or internal tool into a production-ready Markdown specification package for coding agents. Creates PRD/product spec, UX flows, design system brief, technical architecture, ADRs, AI/safety/privacy specs, API/data model, client/backend implementation specs, QA acceptance tests, release readiness, and executable task checklists. Do not use for simple one-off coding tasks unless the user asks for a complete spec, PRD, ADR, project plan for coding agents, or build package.
Determine runtime owner, first-fix layer, and canonical long-term module or package owner in layered codebases. Use when placing code across UI vs platform shell vs runtime orchestration vs domain or application vs shared core vs adapter or integration layers, debugging ownership issues, removing duplicate policy paths, or answering "where should this live?" architecture questions.
Decide exactly where bug-fix test coverage belongs. Use before adding, moving, or deleting tests after a bug fix or architectural change. Select one owning layer, reuse existing canonical suites, block redundant or weakly placed tests, and remove weaker duplicates.
Capture and analyze thread backtraces with LLDB/GDB to debug hangs, deadlocks, UI freezes, IPC stalls, or high-CPU loops across any language or project. Use when an app becomes unresponsive, switching contexts stalls, or you need thread stacks to locate lock inversion or blocking calls.
| name | secleak-check |
| description | Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks, or run secleak-check before release. |
references/guardrails.md.Resolve scripts/secleak-check.sh relative to this SKILL.md.
Common installed path:
/Users/kregenrek/.agents/skills/secleak-check/scripts/secleak-check.sh
betterleaks git --no-banner --redact=100 .
trivy fs --scanners vuln,secret,misconfig --exit-code 1 .
Prefer .betterleaks.toml when present. If only .gitleaks.toml exists, pass --config .gitleaks.toml; BetterLeaks supports it for compatibility.
betterleaks findings are blockers until verified false-positive or remediated.trivy dependency vulnerabilities should be summarized by severity and top fixed versions.node_modules are dependency artifact noise unless that file is built or shipped by the repo.When asked to harden a repo against secret leaks:
.betterleaks.toml, .gitleaks.toml, secret-scan workflows, Dependabot, and hook tooling..forbidden-paths.regex and a staged-file hook..betterleaks.toml with path-based filters only for fixtures.scripts/secleak-check.sh only when the repo wants a first-class local script..gitignore for runtime dirs, env files, credentials, keys, and infra state.Templates live in references/guardrails.md; small examples live in references/examples.md.