skills

1---
2name: credential-safety
3description: Prevents agents from committing or pushing API keys, passwords, tokens, private keys, certificates, or other credentials to remote repositories. Use before commits, pushes, releases, and whenever configuration or authentication code changes.
4---
5 
6# Credential Safety
7 
8Keep secrets out of commits and remote repositories. Treat the current
9worktree, index, commit history, and remote branch state as separate surfaces
10that must be checked before pushing.
11 
12## Check for skill folder updates
13 
14Before applying this skill, check whether the skill folder has updates:
15 
161. Identify the directory where this skill is installed (such as `~/.copilot/skills/`, `~/.gemini/antigravity-cli/skills/`, `~/.claude/skills/`, or the active repository).
172. If the folder is inside a git repository, check git status:
18   ```bash
19   git -C <skill-folder> status --short --branch
20   ```
213. When network access is available, check for upstream changes:
22   ```bash
23   git -C <skill-folder> fetch --dry-run
24   ```
254. If updates are available, pull them before proceeding so you use the latest instructions. If the folder is not a git repository, proceed with the installed files.
26 
27## Inspect before committing or pushing
28 
29- Read repository instructions and identify the intended secret-management
30  method, such as environment variables, ignored local files, or a secret
31  manager.
32- Inspect staged, unstaged, and untracked files. Check filenames and content
33  for API keys, access tokens, passwords, connection strings, session cookies,
34  private keys, certificates, signing files, cloud credential files, and
35  production configuration.
36- Check the commits being pushed, not only the current working tree. A secret
37  in an earlier commit is still exposed when that commit is reachable from the
38  remote branch.
39- Use available repository-approved secret scanners and review their full
40  results. If no scanner is available, use targeted searches and inspect
41  suspicious files without printing complete credential values.
42- Check ignore rules for local secret files. Do not treat `.gitignore` as
43  proof that a file is safe if it is already tracked.
44 
45## What to do when a secret is found
46 
47- Stop the commit or push. Do not work around a scanner finding by weakening
48  patterns, hiding output, or adding the file to an allowlist without review.
49- Remove the secret from the change and replace it with a documented
50  placeholder or environment-based configuration.
51- Revoke or rotate any exposed credential before continuing. Removing a value
52  from the latest file does not invalidate a credential already present in
53  history or logs.
54- If the secret exists in reachable history, explain the exposure and use the
55  repository's approved history-rewrite process only with explicit
56  authorization. Coordinate force-pushes and verify every affected remote
57  branch afterward.
58- Never paste full secrets into chat, commit messages, issue comments, logs, or
59  reports. Identify the file, type, and remediation state without exposing the
60  value.
61 
62## Push gate
63 
64Before any remote push, verify that:
65 
661. The staged diff contains no credentials.
672. The commits being pushed contain no credentials.
683. Secret files are ignored and not tracked unless the repository explicitly
69   requires a safe, non-secret template.
704. The scanner result and manual review cover the complete push range.
715. Any finding is resolved, rotated, and documented before proceeding.
72 
73Do not claim a push is safe because tests pass, the scanner was not installed,
74or no obvious secret was noticed. Report missing tooling or incomplete coverage
75as an unresolved blocker.
76 
77## Required response
78 
79Report the files and commit range checked, the scanner or searches used, the
80result, any finding and rotation status without revealing secret values, and
81whether the push is safe, blocked, or not yet checked.
82