edkuksa/skills
1
0
Fork 0
mirror of https://github.com/mattpocock/skills.git synced 2026-09-12 18:38:06 +07:00
Code Issues Packages Projects Releases Wiki Activity

fix: trim the Redact section to prose

Browse Source 
Drop the curl exemplar and the enumerated secret and artifact lists —
the model does not need to be told what a secret looks like. Three
sentences carry the same rule.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt Pocock
2026-08-06 09:17:31 +01:00
co-authored by Claude Opus 5
parent efce423018
commit bda79a3c3c
2 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/diagnosing-bugs-redact-secrets.md
+1 -1
View File
@@ -4,6 +4,6 @@
Make `diagnosing-bugs` redact secrets. Make `diagnosing-bugs` redact secrets.
- Add a **Redact** section to `SKILL.md`. The skill has the agent show commands, outputs and captured artifacts; the section makes redaction the first move on each — write `<REDACTED>`, show a command's shape (`Bearer $API_TOKEN`) rather than its credential, build loops against env vars, and redact HAR files, log dumps and payloads before quoting them. - Add a **Redact** section to `SKILL.md`. The skill has the agent show commands, outputs and captured artifacts; the section makes redaction the first move on each — write `<REDACTED>`, build loops against env vars so the credential stays in the environment, and quote only the signal-carrying lines of a captured artifact.
- The Phase 1 completion criterion said "paste the invocation and its output". It now says show it redacted, and Phase 1 asks the user for a **redacted** captured artifact. - The Phase 1 completion criterion said "paste the invocation and its output". It now says show it redacted, and Phase 1 asks the user for a **redacted** captured artifact.
- Note in `scripts/hitl-loop.template.sh` that `capture` prints its value back to the terminal, so it takes observations while signing in stays a `step`. - Note in `scripts/hitl-loop.template.sh` that `capture` prints its value back to the terminal, so it takes observations while signing in stays a `step`.
skills/engineering/diagnosing-bugs/SKILL.md
+1 -5
View File
@@ -11,11 +11,7 @@ When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear men
## Redact ## Redact
This skill has you show commands, outputs and captured artifacts. **Redact every secret first** — API keys, tokens, passwords, cookies, session IDs, connection strings, signed URLs. Write `<REDACTED>` in its place. This skill has you show commands, outputs and captured artifacts. **Redact every secret first** — write `<REDACTED>` in its place. Build loops against env vars, so the credential stays in the environment rather than in what you show. Captured artifacts carry auth headers: quote only the lines that carry the signal.
- **Show a command's shape, not its credential**: `curl -H "Authorization: Bearer $API_TOKEN" …`. The env var reference is the redacted form, and it still runs.
- **Build loops against env vars**, so the credential stays in the environment rather than in the file you write or the output you quote.
- **Redact captured artifacts** — HAR files, log dumps and request payloads carry auth headers. Quote only the lines that carry the signal.
If the redacted output is not enough to diagnose the bug, say so and ask the user. If the redacted output is not enough to diagnose the bug, say so and ask the user.