A deliberately leaky demo skill used to show what skill-sanitizer catches before you publish. Do not ship this.
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
This folder is a teaching fixture for skill-sanitizer. It contains planted,
clearly-fake-but-realistic leaks so you can watch the scanner BLOCK on a publish
attempt. Nothing here is a real credential — the values are dummies sized to
look real so the scanner treats them seriously.
| Class | Where | Planted value (fake) |
|---|---|---|
| SECRET | sync.py:5 | a ghp_ GitHub token (36 hex-ish chars) → hard BLOCK |
| PROPRIETARY | sync.py:8 | a hardcoded home-dir path with a username → WARN |
| PII | sync.py:11 | a personal gmail.com email → WARN |
| SERVICE CODE | sync.py | an internal Jira marker (.atlassian.net, customfield_*) → plugin-split advice |
cd examples/dirty-skill
python ../../scanner.py .
Expected: a report with BLOCK=2 WARN=4 and exit code 1. The full expected
report is in ../EXPECTED_OUTPUT.md. Fixing the four
planted leaks (env-var the token, swap the path for ~, use an example.com
email, move the Jira code to a plugin) takes the same folder to exit 0.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Analyze folders of Markdown/text research notes, Obsidian vaults, paper cards, invention notes, or memory exports as a practical knowledge map. Use when asked to find center topics, noisy or low-signal notes, possible contamination, overgrown topic groups, orphan notes, cleanup actions, or a useful public knowledge-hygiene workflow.
The English summary is being prepared. Showing the original description.
Package an AI skill, prompt workflow, or internal operating habit into a public-ready release with a catchy hook, safe redaction, useful examples, demo tasks, README copy, and launch messaging. Use when preparing a skill for GitHub, social sharing, marketplace submission, documentation, or community feedback.
The English summary is being prepared. Showing the original description.
Pre-share leak scanner for Claude Code skills (or any folder). Scans BEFORE you publish for secrets (API keys, tokens, private keys, .env values, high-entropy strings), PII (emails/phones), local machine paths (C:\Users\<name>, /home/<name>, /Users/<name>, UNC, internal hostnames), and client/proper-noun names from a LOCAL private dictionary; also flags service-specific code (jira/github/gitlab/slack/salesforce/notion/linear/ stripe/aws/google) that should be split into a dedicated service plugin. Use when the user says "sanitize this skill", "before sharing a skill", "check for leaks", "is this skill clean", "is this safe to commit/publish/ open-source", "scrub secrets", "redact before commit", or "pre-push leak check". Cross-platform, stdlib-only Python, fail-closed.
The English summary is being prepared. Showing the original description.
Lightweight multi-agent research orchestration using one coordinator, three domain leads, and three lightweight research agents. Use for medium-size research, market scans, competitor comparisons, prior-art style exploration, report planning, and any task that benefits from parallel domain decomposition without running a full high-cost research lab.
The English summary is being prepared. Showing the original description.