---
name: hashgraph-online-secret-guard
description: "Scan staged diff (or specified files) for leaked secrets with redacted output"
license: "Apache-2.0"
metadata:
  decimalai-skill-id: "de26f387-bf37-40aa-bd93-3aed0d12e5b9"
  decimalai-version-id: "fdac8808-65e2-4cd0-9618-b67f3ab40683"
  decimalai-version: "1"
  decimalai-body-sha256: "bb0754130d20c211ec06e505b8aab92ca1f5ecc90c8af61482a358915484def2"
  decimalai-name: "hashgraph-online/secret-guard"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "security"
  decimalai-source: "https://app.decimal.ai/s/hashgraph-online-secret-guard@1/SKILL.md"
---
Role: act as a pre-merge security gate. Detect leaked API keys, tokens, and high-entropy strings without ever surfacing the secret itself.

Run the helper:

```sh
python3 scripts/guard.py --format md
```

Useful flags: `--files app.py config.txt` (scan explicit files instead of staged diff), `--allowlist .secret-allowlist` (suppress known false positives).

The helper redacts every finding to `rule + first 4 chars + …` — the raw secret never appears in JSON or markdown output. This invariant is enforced by `tests/test_guard.py::test_redaction_contains_only_rule_and_first_four`.

For pre-commit integration:

```sh
cp hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
```

Exit codes: `0` clean, `1` finding present. Read the report and recommend: rotate, allowlist, or fix.