secret-handling Skill
Never read .env files or write secrets to .squad/ committed files Published by microsoft in waza.
Decision snapshot
Is this a fit?
Testing, Database workflows, Documentation, Writing
Compatibility not yet detected.
Permission behavior not yet detected.
Copy skill directory
2 months ago · MIT license
No specific cautions were detected. Review the source and requested permissions before installing.
What is secret-handling Skill?
Never read .env files or write secrets to .squad/ committed files Published by microsoft in waza. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Testing
- Database workflows
- Documentation
- Writing
- Testing use cases
Declared skill metadata
- Source file: .copilot/skills/secret-handling/SKILL.md
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
When to use secret-handling Skill
- Use it for testing.
- Use it for database workflows.
- Use it for documentation.
- Use it for writing.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/waza
- Skill file: .copilot/skills/secret-handling/SKILL.md
What it does
Never read .env files or write secrets to .squad/ committed files
Skill instructions
Context Spawned agents have read access to the entire repository, including .env files containing live credentials. If an agent reads secrets and writes them to .squad/ files (decisions, logs, history), Scribe auto-commits them to git, exposing them in remote history. This skill codifies absolute prohibitions and safe alternatives. Patterns Prohibited File Reads NEVER read these files: - .env (production secrets) - .env.local (local dev secrets) - .env.production (production environment) - .env.development (development environment) - .env.staging (staging environment) - .env.test (test environment with real credentials) - Any file matching .env. UNLESS explicitly allowed (see below) Allowed alternatives: - .env.example (safe — contains placeholder values, no real secrets) - .env.sample (safe — documentation template) - .env.template (safe — schema/structure reference) If you need config info: 1. Ask the user directly — "What's the database connection string?" 2. Read .env.example — sho
Verified compatibility and discovery
Frequently asked questions
What is secret-handling?
secret-handling is a open-source AI agent skill with Copy skill directory. Never read .env files or write secrets to .squad/ committed files
Who is secret-handling best for?
secret-handling is best for reusing agent instructions, scripts, and references, testing workflows, database workflows, documentation workflows.
How do I install secret-handling?
Install or run secret-handling using Copy skill directory. Check secret-handling for the latest setup command.
Is secret-handling actively maintained?
secret-handling may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
