Agent Skills
› aiming-lab/MetaClaw
› secrets-management
secrets-management
GitHub处理API密钥、密码等敏感凭据，禁止硬编码。开发用环境变量，生产用密钥管理服务。提交前忽略敏感文件，泄露后立即轮换。CI中使用扫描工具拦截含秘密的提交，防止日志泄露。
Trigger Scenarios
任务涉及API key, password, token, private key或secret
需要配置环境凭证或管理敏感数据
Install
npx skills add aiming-lab/MetaClaw --skill secrets-management -g -y
SKILL.md
Frontmatter
{
"name": "secrets-management",
"category": "security",
"description": "Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word \"key\", \"token\", \"password\", or \"secret\" appears in the task."
}
Secrets Management
Rules:
- Never hardcode secrets in source files, configs committed to git, or logs.
- Use environment variables for local development (
python-dotenv). - Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
- Add
.envand*.pemto.gitignorebefore the first commit. - Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).
Scanning: Use ggshield, truffleHog, or git-secrets in CI to block secret commits.
Anti-patterns:
os.environ.get('KEY', 'hardcoded_default')in production code.- Logging full request/response bodies that may contain tokens.
Version History
- 922caf3 Current 2026-07-25 11:08
