Secret Handling
Never read .env files or write secrets to .squad/ committed files
Install
npx skills add microsoft/waza --skill secret-handling -g -a claude-code -y- Repository
- microsoft/waza1.5k
- Category
- Writing
- Updated
- 4d ago
- License
- MIT
- Context cost
- Mediumabout 1,802 tokens
- Runs scripts
- No, instructions only
What it does
Never read .env files or write secrets to .squad/ committed files
Context
Spawned agents have read access to the entire repository, including .env files containing live credentials. If an agent reads secrets and writes them to .squad/ files (decisions, logs, history), Scribe auto-commits them to git, exposing them in remote history. This skill codifies absolute prohibitions and safe alternatives.
Patterns
Prohibited File Reads
NEVER read these files:
.env(production secrets).env.local(local dev secrets).env.production(production environment).env.development(development environment).env.staging(staging environment).env.test(test environment with real credentials)- Any file matching
.env.*UNLESS explicitly allowed (see below)
Allowed alternatives:
.env.example(safe, contains placeholder values, no real secrets).env.sample(safe, documentation template).env.template(safe, schema/structure reference)
If you need config info:
- Ask the user directly, "What's the database connection string?"
- Read
.env.example, shows structure without exposing secrets - Read documentation, check
README.md,docs/, config guides
NEVER assume you can "just peek at .env to understand the schema." Use .env.example or ask.
Prohibited Output Patterns
NEVER write these to .squad/ files:
