[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GPHCS6V73C959PN8W370SS":3,"skill-same:01M6GPHCS6V73C959PN8W370SS":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":29,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6GPHCS6V73C959PN8W370SS","secrets-detection",null,"Finds hardcoded secrets in any project — API keys (AWS, GitHub, Google, Stripe, Slack), passwords, tokens, private keys, JWTs, database URLs with credentials. Runs a fast regex scan, then triages matches to remove false positives and checks .env\u002Fgit hygiene. Use when auditing a codebase for leaked credentials or before committing\u002Fpublishing a repo.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002FSKILL.md",[19,24],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":25,"categoryName":26,"taxonomyType":27,"taxonomyTypeDesc":28},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"secrets detection","detection","secrets","publishing","passwords","with","false","env","regex","tokens","project","scan","slack","use","remove","repo","api","credentials","database","github","2026-11-10 10:12:30",false,"---\nname: secrets-detection\ndescription: Finds hardcoded secrets in any project — API keys (AWS, GitHub, Google, Stripe, Slack), passwords, tokens, private keys, JWTs, database URLs with credentials. Runs a fast regex scan, then triages matches to remove false positives and checks .env\u002Fgit hygiene. Use when auditing a codebase for leaked credentials or before committing\u002Fpublishing a repo.\nlicense: MIT\n---\n\n# Secrets Detection\n\n## Step 1 — Fast regex scan\n\n```bash\nbash scripts\u002Fscan.sh \u003Cproject_root>\n```\n\nThe script greps the pattern set in `references\u002Fpatterns.txt` (one ERE regex per line — edit that file to tune, not the script). Output: `file:line:matched line`.\n\nIf `grep -rE` is unavailable, replicate manually with `rg -n` using the same patterns file.\n\n## Step 2 — Triage (kill false positives)\n\nFor each hit, read the surrounding code and drop it if the value is:\n\n- A placeholder: `example`, `test`, `dummy`, `sample`, `changeme`, `placeholder`, `xxx`, `your_...`, `todo`, `\u003C...>`, `***`, `...`\n- In an obvious fixture\u002Fmock: paths containing `test\u002F`, `__tests__\u002F`, `fixtures\u002F`, `examples\u002F`, `docs\u002F`, `*.md` code blocks\n- A variable reference, not a literal: `API_KEY=$API_KEY`, `password: process.env.PW`\n- An intentional canary\u002Fhoneypot token (look for comments like `canary`, `honeypot`, or a monitoring URL)\n\nKeep — and flag as CRITICAL — anything that looks real: correct prefix + realistic entropy + committed to git history.\n\n## Step 3 — Hygiene checks\n\n```bash\ngit ls-files | rg -i '\\.env($|\\.)'          # .env files tracked?\ncat .gitignore 2>\u002Fdev\u002Fnull | rg -i 'env|secret|key|pem'   # .env ignored?\ngit log --all --oneline -S 'AKIA' -- '*.py' 2>\u002Fdev\u002Fnull | head  # leaked keys in history?\nrg -n --hidden -g '!*.lock' -g '!package-lock.json' '(BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY)' \u003Croot>\n```\n\nReport:\n\n1. **Committed real secrets** → CRITICAL. Fix: rotate\u002Frevoke immediately (a removed file is not a revoked key), then scrub history (`git filter-repo` \u002F BFG).\n2. **Tracked `.env` files** → CRITICAL regardless of content.\n3. **Secrets in git history but not HEAD** → HIGH (history is forever on clones\u002Fforks).\n4. **Placeholder secrets in prod-looking config** → MEDIUM (someone will \"temporarily\" deploy them).\n5. **Secrets handling patterns** — note whether the project uses env vars \u002F secret manager properly, and whether secrets can leak into logs (see also `..\u002Fdata-exposure\u002FSKILL.md`).\n\n## Step 4 — Dev-artifact leak surface (developer tools commit secrets too)\n\n```bash\nrg --files --hidden -g '.vscode\u002F**' -g '.idea\u002F**' -g '*.postman_collection.json' -g '*.postman_environment.json' -g '*.http' -g '*.rest' -g 'devcontainer.json' -g '*.insomnia*' | head\nrg -n -i \"token|secret|password|api[_-]?key|authorization\" .vscode\u002F .idea\u002F *.postman* *.http devcontainer.json 2>\u002Fdev\u002Fnull | head\n```\n\n- **Postman\u002FInsomnia collections & environments**: live `Authorization: Bearer …` headers, saved logins — these files are SHARED and committed by design → CRITICAL (rotate on sight)\n- **`.vscode\u002Flaunch.json` \u002F `.idea\u002Fworkspace.xml`**: `env`\u002F`ENV` blocks with tokens and DB URLs → HIGH; also debug `console`\u002F`attach` configs revealing internal hosts\n- **`.http`\u002F`.rest` request files**: same class — request headers with real credentials → HIGH\u002FCritical\n- **`devcontainer.json` \u002F `codespaces`**: secrets in `containerEnv`\u002F`remoteEnv`, PATs in feature options → HIGH\n- **Swagger\u002FOpenAPI `examples:`** that are real payloads (real users, real tokens) → Medium\u002FHigh\n\nSame triage rules apply (fakes\u002Ffixtures dropped); these surfaces pair with the generic patterns from Step 1 — the difference is WHERE to look, not WHAT to match.\n\n## Notes\n\n- Scan binary-free (`-I`) and exclude vendored dirs — the script does this already.\n- Encoded secrets (base64, hex blobs near words like `key`, `token`, `secret`) deserve a look: decode and judge.\n- `references\u002Fpatterns.md` documents each pattern, its false-positive profile, and how to add new ones.\n- **Optional bridge:** if `gitleaks`\u002F`trufflehog` is installed (probe: `..\u002Fsecurity-audit\u002Fscripts\u002Fprobe_tools.sh`), run it too — it scans **full git history**, where worktree regex cannot see deleted-then-rotated keys. Merge hits into Step 2 triage; same false-positive rules apply.\n","# Secrets Detection\n\n## Step 1 — Fast regex scan\n\n```bash\nbash scripts\u002Fscan.sh \u003Cproject_root>\n```\n\nThe script greps the pattern set in `references\u002Fpatterns.txt` (one ERE regex per line — edit that file to tune, not the script). Output: `file:line:matched line`.\n\nIf `grep -rE` is unavailable, replicate manually with `rg -n` using the same patterns file.\n\n## Step 2 — Triage (kill false positives)\n\nFor each hit, read the surrounding code and drop it if the value is:\n\n- A placeholder: `example`, `test`, `dummy`, `sample`, `changeme`, `placeholder`, `xxx`, `your_...`, `todo`, `\u003C...>`, `***`, `...`\n- In an obvious fixture\u002Fmock: paths containing `test\u002F`, `__tests__\u002F`, `fixtures\u002F`, `examples\u002F`, `docs\u002F`, `*.md` code blocks\n- A variable reference, not a literal: `API_KEY=$API_KEY`, `password: process.env.PW`\n- An intentional canary\u002Fhoneypot token (look for comments like `canary`, `honeypot`, or a monitoring URL)\n\nKeep — and flag as CRITICAL — anything that looks real: correct prefix + realistic entropy + committed to git history.\n\n## Step 3 — Hygiene checks\n\n```bash\ngit ls-files | rg -i '\\.env($|\\.)'          # .env files tracked?\ncat .gitignore 2>\u002Fdev\u002Fnull | rg -i 'env|secret|key|pem'   # .env ignored?\ngit log --all --oneline -S 'AKIA' -- '*.py' 2>\u002Fdev\u002Fnull | head  # leaked keys in history?\nrg -n --hidden -g '!*.lock' -g '!package-lock.json' '(BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY)' \u003Croot>\n```\n\nReport:\n\n1. **Committed real secrets** → CRITICAL. Fix: rotate\u002Frevoke immediately (a removed file is not a revoked key), then scrub history (`git filter-repo` \u002F BFG).\n2. **Tracked `.env` files** → CRITICAL regardless of content.\n3. **Secrets in git history but not HEAD** → HIGH (history is forever on clones\u002Fforks).\n4. **Placeholder secrets in prod-looking config** → MEDIUM (someone will \"temporarily\" deploy them).\n5. **Secrets handling patterns** — note whether the project uses env vars \u002F secret manager properly, and whether secrets can leak into logs (see also `..\u002Fdata-exposure\u002FSKILL.md`).\n\n## Step 4 — Dev-artifact leak surface (developer tools commit secrets too)\n\n```bash\nrg --files --hidden -g '.vscode\u002F**' -g '.idea\u002F**' -g '*.postman_collection.json' -g '*.postman_environment.json' -g '*.http' -g '*.rest' -g 'devcontainer.json' -g '*.insomnia*' | head\nrg -n -i \"token|secret|password|api[_-]?key|authorization\" .vscode\u002F .idea\u002F *.postman* *.http devcontainer.json 2>\u002Fdev\u002Fnull | head\n```\n\n- **Postman\u002FInsomnia collections & environments**: live `Authorization: Bearer …` headers, saved logins — these files are SHARED and committed by design → CRITICAL (rotate on sight)\n- **`.vscode\u002Flaunch.json` \u002F `.idea\u002Fworkspace.xml`**: `env`\u002F`ENV` blocks with tokens and DB URLs → HIGH; also debug `console`\u002F`attach` configs revealing internal hosts\n- **`.http`\u002F`.rest` request files**: same class — request headers with real credentials → HIGH\u002FCritical\n- **`devcontainer.json` \u002F `codespaces`**: secrets in `containerEnv`\u002F`remoteEnv`, PATs in feature options → HIGH\n- **Swagger\u002FOpenAPI `examples:`** that are real payloads (real users, real tokens) → Medium\u002FHigh\n\nSame triage rules apply (fakes\u002Ffixtures dropped); these surfaces pair with the generic patterns from Step 1 — the difference is WHERE to look, not WHAT to match.\n\n## Notes\n\n- Scan binary-free (`-I`) and exclude vendored dirs — the script does this already.\n- Encoded secrets (base64, hex blobs near words like `key`, `token`, `secret`) deserve a look: decode and judge.\n- `references\u002Fpatterns.md` documents each pattern, its false-positive profile, and how to add new ones.\n- **Optional bridge:** if `gitleaks`\u002F`trufflehog` is installed (probe: `..\u002Fsecurity-audit\u002Fscripts\u002Fprobe_tools.sh`), run it too — it scans **full git history**, where worktree regex cannot see deleted-then-rotated keys. Merge hits into Step 2 triage; same false-positive rules apply.\n",{"name":5,"license":15,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fchains\u002Fashrafiucse-secrets-detection",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-14 02:27:51",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill secrets-detection",{"tool":70,"command":71},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill secrets-detection",{"tool":73,"command":74},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill secrets-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002FSKILL.md",true,[78,82,88,92,98,102],{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":16},"LICENSE","许可证",1067,{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fpatterns.md","REFERENCE","参考文档",2564,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002Freferences\u002Fpatterns.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fpatterns.txt",2419,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002Freferences\u002Fpatterns.txt",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fscan.sh","SCRIPT","脚本",931,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002Fscripts\u002Fscan.sh",{"path":99,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":100,"sourceHtmlUrl":101},"SOURCE.md",374,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002FSOURCE.md",{"path":103,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":104,"sourceHtmlUrl":105},"TRUST.auto.yaml",2176,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Fashrafiucse-secrets-detection\u002FTRUST.auto.yaml",[107,135,157,175,188,198],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":111,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":50},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":139,"licenseFileUrl":140,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":50},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[144,145,146,46,147,148,149,150,151,152,153,154,155,156],"mexc spot websocket","spot","websocket","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":139,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":50},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[165,145,166,167,168,169,170,154,153,152,171,172,173,148,174,147,46],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":139,"licenseFileUrl":179,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":50},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[183,184,146,185,186,155,153,187,151,150,148,147],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":189,"name":190,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":191,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":50},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[195,196,197],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":202,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":50},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[206,207,208,209,210,211,212,43,213,214,215],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]