Agent Skills
› aiming-lab/MetaClaw
› secrets-management
secrets-management
GitHub处理API密钥、密码等敏感凭据的安全规范。禁止硬编码，推荐环境变量或专业密钥管理服务，强调.gitignore配置及泄露后的紧急轮换机制，并提供CI扫描工具建议以防止凭证泄露。
Trigger Scenarios
涉及API keys, passwords, tokens的硬编码风险
需要配置生产环境密钥管理
发现凭据可能已泄露需轮换
任务描述中包含key, token, password, secret
Install
npx skills add aiming-lab/MetaClaw --skill secrets-management -g -y
SKILL.md
Frontmatter
{
"name": "secrets-management",
"category": "security",
"description": "Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word \"key\", \"token\", \"password\", or \"secret\" appears in the task."
}
Secrets Management
Rules:
- Never hardcode secrets in source files, configs committed to git, or logs.
- Use environment variables for local development (
python-dotenv). - Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
- Add
.envand*.pemto.gitignorebefore the first commit. - Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).
Scanning: Use ggshield, truffleHog, or git-secrets in CI to block secret commits.
Anti-patterns:
os.environ.get('KEY', 'hardcoded_default')in production code.- Logging full request/response bodies that may contain tokens.
Version History
- 922caf3 Current 2026-07-25 11:08
