Frank
a34322aeb0
The managed-skill library was regenerated: 94 narrow per-incident skills
replaced by 25 broader ones (radiance-*, llamacpp-*, homepage-*, fleet/
endpoint ops). Git renders this as mass delete + mass add because whole
directories changed name; old content stays in history at 12c5e88.
Surface check: the 25 on disk are exactly the skills the harness advertises
this session.
1.9 KiB
1.9 KiB
name, description
| name | description |
|---|---|
| defuse-shell-rc-secrets | Find literal API keys/tokens in shell rc files and replace them with 600-perm secret files + loader lines, syncing the canonical tool token file. |
Defuse shell-rc secrets
Symptom: export KEY=... literal in .zshrc/.bashrc — world-readable in every process env, one git add -A from a dotfiles repo.
Procedure (repeat per host)
- Sweep:
grep -n "export.*KEY\|export.*TOKEN" ~/.zshrc ~/.zprofile ~/.profile ~/.bashrc 2>/dev/null(run per host; when batching hosts in one ssh compound command, label which output came from which host — misattribution wastes turns). - Extract WITHOUT echoing:
mkdir -p ~/.config/secrets && chmod 700it, thensed -n 's/^export NAME="\(.*\)"$/\1/p' ~/.zshrc > ~/.config/secrets/<name>(quote variant and unquoted variant are different sed patterns — verify byte counts withwc -c, a 0-byte file means the pattern missed). chmod 600every secret file; sync any canonical tool file the ecosystem expects (e.g.~/.cache/huggingface/token).- Replace the rc literal (hashline
PUT N.=N:range — never echo the secret in the op):[ -f ~/.config/secrets/<name> ] && export NAME="$(cat ~/.config/secrets/<name>)". - Verify:
zsh -n ~/.zshrc(orbash -n); keep a dated.bakof the rc on remote hosts; shred any /tmp transfer copies immediately (shred -u).
Laws
- A token pasted into chat lands in transcripts and model context — treat chat as a leak channel; give the user the
read -rssnippet instead. - scp of a secret FILE (encrypted channel, no argv) is fine; the token is never a command-line argument.
- After replacing a legacy HF token, probe scope non-destructively:
HfApi().whoami()(legacy read tokens showtype: access_tokenwithout canWrite; the decisive probe iscreate_repo(exist_ok=True)on the real target repo). - Verify extraction byte-count before deleting/trusting; a successful-looking sed can write an empty file.