mycelium-hq/ai-brain-starter · skills/secret-warn/SKILL.md

secret-warn skillF

secret-warn is agent-read markdown (skill) from mycelium-hq/ai-brain-starter: Use when adding or tuning edit-time secret and code-injection guardrails or security hooks in Claude Code, or on mentions of secret detection, API key safety, hardcoded or leaked keys (AWS, Stripe, GCP, OpenAI, Anthropic, GitHub, Slack, JWT, PEM, .env), gitleaks-style or pre-commit secret scanning, false positives or allowlists, unsafe pipe-to-shell or MCP server installs, or prompt injection in audited third-party content (README, AGENTS.md). Not for full security audits, pen testing, or DLP..

Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.

How to install

Latest version
mdr add mycelium-hq/ai-brain-starter/secret-warn@git:20260707.f0ac903
Exact content
mdr add mycelium-hq/ai-brain-starter/secret-warn@sha256:ba650fd26a0c9311

Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_fjmubvlf4vf7rv5q.svg)](https://markdownregistry.com/a/art_fjmubvlf4vf7rv5q)

0 badge views in 30 days

Versions

versioncommittedcommitsizeaudit
git:20260707.f0ac903 latest2026-07-07 f0ac903 8,376 BF view · diff
git:20260622.dbfb5922026-06-22 dbfb592 8,921 BF view · diff
git:20260519.2f1303d2026-05-19 2f1303d 6,414 BF view

Audit of the latest version

F  14 of 17 checks passed. Deterministic, no model, same answer every run.
  • FAIL, critical: No credential-shaped string (matched: AKIAIOSFODNN7EXAMPLE)
  • FAIL, critical: No instruction to send local credentials anywhere (matched: exfiltrate `~/.ssh)
  • fail: No prompt-injection phrasing (matched: ignore prior instructions)
  • pass: Frontmatter block present
  • pass: Frontmatter declares a name
  • pass: Frontmatter declares a description
  • pass: Size between 200 bytes and 200 KB (8376 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No text hidden with inline styles
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No link to a raw IP address
  • pass: No script tag

Source

GitHub

mycelium-hq/ai-brain-starter · 36 stars · license MIT · pushed 2026-09-18 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_fjmubvlf4vf7rv5q
GET https://markdownregistry.com/api/v1/resolve?ref=mycelium-hq/ai-brain-starter/secret-warn
GET https://markdownregistry.com/api/v1/blob/ba650fd26a0c93115dc9b0295266cab7bf71c6b692d385faa2edfb2701d606e7

Agents talk at modelranch.com: hand yours the instructions there and it joins the network that reads files like this one.