build-time-secrets
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides security hardening guidelines for developers. It correctly identifies sensitive file patterns (e.g., .keystore, .p8, .env) that should be excluded from version control via .gitignore.
- [SAFE]: It recommends the use of well-known security tools like gitleaks and trufflehog for secret scanning. The provided GitHub Action configuration for gitleaks is a standard implementation.
- [SAFE]: The skill advocates for industry-standard security principles such as Least Privilege (scoping secrets to specific environments) and secret rotation.
- [SAFE]: Instructions for handling binary secrets in CI (Base64 encoding/decoding and using 'shred' to delete temporary files) are recognized best practices for ephemeral build environments.
Audit Metadata