# Auto Skill Safety Mcp Secret Guard

> >

- **Type:** Skill
- **Install:** `agentstack add skill-arnie016-codex-prompt-templates-auto-skill-safety-mcp-secret-guard`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Arnie016](https://agentstack.voostack.com/s/arnie016)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Arnie016](https://github.com/Arnie016)
- **Source:** https://github.com/Arnie016/codex-prompt-templates/tree/main/skills/auto-skill-safety-mcp-secret-guard
- **Website:** https://github.com/Arnie016/codex-prompt-templates

## Install

```sh
agentstack add skill-arnie016-codex-prompt-templates-auto-skill-safety-mcp-secret-guard
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP Secret Guard (Config Hygiene)

Generated by: Codex Supercharge maintenance automation.

Goal: keep credentials out of repos, prompts, and MCP config files while still producing a usable config snippet.

## Trigger

- You are adding/editing MCP config (e.g., `mcpServers` JSON).
- A repo/README shows tokens/keys in examples.
- Logs or screenshots may include secrets.

## Workflow

1. **Identify config surfaces**
   - Search for likely MCP config locations:
     - `rg -n \"\\bmcpServers\\b\" -S --hidden .`
     - `rg -n \"mcp\" -S --hidden .codex* ~/.codex 2>/dev/null || true`
2. **Detect secret-shaped strings (local only)**
   - Run conservative scans (don’t paste results into chat unredacted):
     - `rg -n \"(api[_-]?key|access[_-]?token|secret|private[_-]?key|bearer)\" -S --hidden .`
     - `rg -n \"sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}\" -S --hidden .`
3. **Normalize config to env-var references**
   - Replace inline secrets with env-var placeholders:
     - Prefer `"env": { \"API_KEY\": \"${API_KEY}\" }` style.
     - Never commit `.env`; add to `.gitignore` if needed.
4. **Redact before sharing**
   - Any time you must include an example, redact to:
     - `***REDACTED***` or `${ENV_VAR}` (never partial key fragments).
5. **Record where secrets should live**
   - OS keychain / password manager / CI secret store.
   - Minimal env var list required to run.

## Output

```md
# MCP Secret Hygiene Report
Config files checked:
Findings (redacted):
Required env vars:
Redaction actions taken:
Remaining risks:
```

## Skip When

- You are only reviewing high-level architecture and no configs/logs are involved.

## Validation

- Re-run the scans in step 2 after edits; expect **0** inline secrets in tracked files.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Arnie016](https://github.com/Arnie016)
- **Source:** [Arnie016/codex-prompt-templates](https://github.com/Arnie016/codex-prompt-templates)
- **License:** MIT
- **Homepage:** https://github.com/Arnie016/codex-prompt-templates

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arnie016-codex-prompt-templates-auto-skill-safety-mcp-secret-guard
- Seller: https://agentstack.voostack.com/s/arnie016
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.