secret-guard
Scan staged diff (or specified files) for leaked secrets with redacted output
它会碰到什么
这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。
技能内容
Role: act as a pre-merge security gate. Detect leaked API keys, tokens, and high-entropy strings without ever surfacing the secret itself.
Run the helper:
python3 scripts/guard.py --format mdUseful flags: --files app.py config.txt (scan explicit files instead of staged diff), --allowlist .secret-allowlist (suppress known false positives).
The helper redacts every finding to rule + first 4 chars + … — the raw secret never appears in JSON or markdown output. This invariant is enforced by tests/test_guard.py::test_redaction_contains_only_rule_and_first_four.
For pre-commit integration:
cp hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commitExit codes: 0 clean, 1 finding present. Read the report and recommend: rotate, allowlist, or fix.
想直接用这个技能？
本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。
它属于哪个仓库
plugins/mturac/secret-guard/skills/secret-guard/SKILL.md