Auto Skill Safety Mcp Secret Guard

MCP Secret Guard (Config Hygiene)

Generated by: Codex Supercharge maintenance automation.

Goal: keep credentials out of repos, prompts, and MCP config files while still producing a usable config snippet.

Trigger

• You are adding/editing MCP config (e.g., mcpServers JSON).
• A repo/README shows tokens/keys in examples.
• Logs or screenshots may include secrets.

Workflow

1. Identify config surfaces

• Search for likely MCP config locations:
• rg -n \"\\bmcpServers\\b\" -S --hidden .
• rg -n \"mcp\" -S --hidden .codex* ~/.codex 2>/dev/null || true

1. Detect secret-shaped strings (local only)

• Run conservative scans (don’t paste results into chat unredacted):
• rg -n \"(api[_-]?key|access[_-]?token|secret|private[_-]?key|bearer)\" -S --hidden .
• rg -n \"sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}\" -S --hidden .

1. Normalize config to env-var references

• Replace inline secrets with env-var placeholders:
• Prefer "env": { \"API_KEY\": \"${API_KEY}\" } style.
• Never commit .env; add to .gitignore if needed.

1. Redact before sharing

• Any time you must include an example, redact to:
• ***REDACTED*** or ${ENV_VAR} (never partial key fragments).

1. Record where secrets should live

• OS keychain / password manager / CI secret store.
• Minimal env var list required to run.

Output

# MCP Secret Hygiene Report
Config files checked:
Findings (redacted):
Required env vars:
Redaction actions taken:
Remaining risks:

Skip When

• You are only reviewing high-level architecture and no configs/logs are involved.

Validation

• Re-run the scans in step 2 after edits; expect 0 inline secrets in tracked files.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Arnie016
• Source: Arnie016/codex-prompt-templates
• License: MIT
• Homepage: https://github.com/Arnie016/codex-prompt-templates

Install and usage instructions live in the source repository linked above.