[joaopedroplinta]

Summary

Adds the env-secrets-guard skill (arch-quality track). It helps agents catch credential leaks before a commit or push:

• hardcoded provider keys (AWS, GitHub, Anthropic, OpenAI, Google, Hugging Face, Slack) and PEM private key headers
• literal values assigned to secret-like names (secret, password, api_key, ...)
• real .env* files that are tracked by git or not covered by .gitignore

The Level 3 script scripts/scan_secrets.py uses only the Python standard library, supports --json, exits 0 (clean), 1 (findings) or 2 (invalid path), never reads the content of real .env* files, and redacts matches to a 4-character prefix.

Closes #

N/A (Catalog contribution, Track A)

Contribution Track & Type of Change

• Track A — Catalog (catalog/): New or updated Skill (SKILL.md) or Subagent (SUBAGENT.md) (Issue optional)
• Track B — Core Solution (src/, .github/, docs/): CLI, TUI, transpiler, tests, or infrastructure (Issue required)

Pre-Flight & Governance Checklist

• Issue Policy: isolated to catalog/ (Track A). The only other edits are catalog-count assertions in two existing tests and a CHANGELOG.md entry.
• English Only (en-US)
• Catalog Contract:
  • SKILL.md description is 56 words, starts with "Use when...", includes negative triggers; body is 60 lines (INV-SKILL-01).
  • Verified dry-run transpilation: node dist/cli.js add env-secrets-guard --targets all --dry-run plans 41 files across the 28 targets.
• Verification Gates: npm run lint, npm test (16/16) and npm run build pass locally.
• Sanitization: no local paths, usernames or real keys. The test fixtures for the scanner were generated at test time and are not committed.

Notes for reviewers

• No evals/benchmark.json is included, on purpose. SKILL_CONTRACT.md lists it, but the eval runner was removed in refactor(cli): strip secondary commands and keep only add and remove #158 and the CLI now only exposes add and remove. The old runner (src/eval/index.ts before refactor(cli): strip secondary commands and keep only add and remove #158) does not execute any agent: it validates a pre-written benchmark.json, or, when the file is missing, falls back to hardcoded values (0.95 vs 0.62). I did not want to commit numbers that were not measured, so this skill has evals/evals.json (3 scenarios, schema-valid) but no benchmark. A real with/without-skill measurement could be a follow-up.
• Test edits: tests/npx_core.test.ts and tests/router_sync.test.ts hardcoded the catalog size (1 skill, 1 subagent). I updated the counts and the expected order, since any new catalog entry would break them. Making those assertions independent of the catalog contents could be a separate cleanup.
• Scanner scope: it is heuristic and does not inspect git history, so a clean result does not prove the repo is free of secrets.

🤖 Generated with Claude Code