security
Installation
SKILL.md
Security
Rule
Use the framework's security primitives everywhere. Never bypass them.
Absolute Secrets Rule
Never hardcode secret values or real private data. This applies to source code, docs, tests, fixtures, generated prompts, screenshots, seed data, and extension HTML just as much as production code.
Do not paste or invent real-looking API keys, bearer tokens, OAuth refresh
tokens, webhook URLs, signing secrets, private Builder/internal data, or customer
data into the repo. Examples must use obvious placeholders such as
<OPENAI_API_KEY>, ${keys.SLACK_WEBHOOK}, sk-test-example, or
example.customer@example.com. Test literals should be clearly fake and must
not match real provider token formats when an example token will do.