edkuksa/skills
1
0
Fork 0
mirror of https://github.com/mattpocock/skills.git synced 2026-09-12 10:28:06 +07:00
Code Issues Packages Projects Releases Wiki Activity

fix: trim the Redact section to prose

Browse Source 
Drop the curl exemplar and the enumerated secret and artifact lists —
the model does not need to be told what a secret looks like. Three
sentences carry the same rule.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt Pocock
2026-08-06 09:17:31 +01:00
co-authored by Claude Opus 5
parent efce423018
commit bda79a3c3c
2 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/diagnosing-bugs-redact-secrets.md
+1 -1
View File
@@ -4,6 +4,6 @@
Make `diagnosing-bugs` redact secrets.
- Add a **Redact** section to `SKILL.md`. The skill has the agent show commands, outputs and captured artifacts; the section makes redaction the first move on each — write `<REDACTED>`, show a command's shape (`Bearer $API_TOKEN`) rather than its credential, build loops against env vars, and redact HAR files, log dumps and payloads before quoting them.
- Add a **Redact** section to `SKILL.md`. The skill has the agent show commands, outputs and captured artifacts; the section makes redaction the first move on each — write `<REDACTED>`, build loops against env vars so the credential stays in the environment, and quote only the signal-carrying lines of a captured artifact.
- The Phase 1 completion criterion said "paste the invocation and its output". It now says show it redacted, and Phase 1 asks the user for a **redacted** captured artifact.
- Note in `scripts/hitl-loop.template.sh` that `capture` prints its value back to the terminal, so it takes observations while signing in stays a `step`.
skills/engineering/diagnosing-bugs/SKILL.md
+1 -5
View File
@@ -11,11 +11,7 @@ When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear men
## Redact
This skill has you show commands, outputs and captured artifacts. **Redact every secret first** — API keys, tokens, passwords, cookies, session IDs, connection strings, signed URLs. Write `<REDACTED>` in its place.
- **Show a command's shape, not its credential**: `curl -H "Authorization: Bearer $API_TOKEN" …`. The env var reference is the redacted form, and it still runs.
- **Build loops against env vars**, so the credential stays in the environment rather than in the file you write or the output you quote.
- **Redact captured artifacts** — HAR files, log dumps and request payloads carry auth headers. Quote only the lines that carry the signal.
This skill has you show commands, outputs and captured artifacts. **Redact every secret first** — write `<REDACTED>` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal.
If the redacted output is not enough to diagnose the bug, say so and ask the user.