secrets-hygiene SKILL.md skillA
secrets-hygiene from mehranqadirian/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add mehranqadirian/skills/secrets-hygiene@git:20261101.00f94f2Pins git:20261101.00f94f2 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- mehranqadirian/skills
- Path
security/secrets-hygiene/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261101.00f94f2, committed Nov 1, 2026
- Size
- 3,233 bytes
- Repository stars
- 13
- License
- none declared
Prevents and responds to leaked credentials in code and git repositories. Use whenever the user commits or pushes code, handles API keys, tokens, passwords, .env files or SSH keys, asks to scan a repo for secrets, set up a pre-commit guard, write a .gitignore for credentials, or says a token was leaked or pasted by mistake, even if they only say "is it safe to push this". Scans with masked output and gives a rotate-first response plan.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# secrets-hygiene
Keep credentials out of repositories, and respond correctly when one leaks. The scanner masks every match, so running it never spreads a secret further.
```
secrets-hygiene/
├── SKILL.md
├── scripts/
│ ├── scan_secrets.py scan staged changes, tracked files or paths; masked output
│ └── install_hook.sh pre-commit hook that blocks commits containing secrets
└── references/
└── leak-response.md rotate-first plan, history purge, .gitignore, prevention
```
## When to use
- Before a commit or push
- Reviewing a repo, zip or config for credentials
- Setting up `.gitignore` and `.env` handling
- A token, key or password was pasted, committed or logged
## Workflow
1. **Scan** before committing: `python3 scripts/scan_secrets.py --staged`
2. **Fix** findings by moving values to environment variables or a secret manager; commit `.env.example` with fake values.
3. **Guard**: `bash scripts/install_hook.sh` so the scan runs on every commit.
4. **Audit** an existing repo: `python3 scripts/scan_secrets.py --all`
5. **If something leaked**, follow the order in `references/leak-response.md`: revoke first, then clean.
## What the scanner finds
…Read the whole file at its exact version.
How to install
mdr add mehranqadirian/skills/secrets-hygiene@sha256:d8a105c99320e34dThe line at the top of this page pins the label git:20261101.00f94f2, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_qyyjr23puugu3c57)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Nov 1, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3233 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mehranqadirian/skills · 13 stars · license none declared · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_qyyjr23puugu3c57 GET https://markdownregistry.com/api/v1/resolve?ref=mehranqadirian/skills/secrets-hygiene GET https://markdownregistry.com/api/v1/blob/d8a105c99320e34d0a13fd3931b29184a31d65ac5a56bf38ed03de53a40a98c9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from mehranqadirian/skills
Every file in mehranqadirian/skills