스킬 whatileaked

📦

whatileaked

Name: whatileaked
Author: selan-ai

콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🔑 환경 변수

Find Credentials Leaked in AI Coding Histories

AI coding histories can retain credentials after they were shared with a model provider. This skill finds affected records while keeping reported secrets masked.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "whatileaked" from https://skillstore.io/skills/selan-ai-whatileaked.md and its manifest at https://skillstore.io/api/skills/selan-ai-whatileaked/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/selan-ai-whatileaked.md 서명된 manifest GET /api/skills/selan-ai-whatileaked/manifest 서명된 lockfile GET /api/skills/selan-ai-whatileaked/lockfile

테스트해 보기

"whatileaked" 사용 중입니다. Scan my coding-agent histories for leaked credentials.

예상 결과:

The scan found two fingerprints across three files. Rotate the likely production credential before considering local cleanup.

"whatileaked" 사용 중입니다. Are these two findings the same credential?

예상 결과:

Yes. The matching fingerprint indicates one credential appeared in both locations, although the secret itself remains masked.

"whatileaked" 사용 중입니다. Help me interpret a masked test-key finding.

예상 결과:

The context suggests a test fixture rather than an active credential.
Confirm the source file and deployment use before dismissing it.
Rotate the credential if its status remains uncertain.

보안 감사

높은 위험

v1 • 2026. 8. 30. 버전별 보고서 열기

All four static findings are false positives caused by Markdown prose and masked examples, not executable Ruby or environment access. The skill still introduces real risks by installing an external package and offering an irreversible wipe operation.

스캔된 파일

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

SKILL.md:42-48

Irreversible Transcript Wipe

The optional wipe command rewrites files in place and cannot be undone. Explicit user initiation and typed confirmation reduce accidental activation but do not remove the impact.

The skill directly states that the command rewrites files in place and cannot be undone. It also documents the confirmation safeguards.

중간

SKILL.md:20-26

External Package Installation and Execution

The skill can install a global npm package and then run it against local histories that may contain credentials. User approval is required, but package integrity is not pinned.

The installation command and approval requirement are explicit. The reviewed file provides no version pin or integrity verification.

위험 요인

⚙️ 외부 명령어 (2)

SKILL.md:28 SKILL.md:40

🔑 환경 변수 (1)

SKILL.md:40

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/selan-ai-whatileaked/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/selan-ai-whatileaked/security.svg)](https://skillstore.io/skills/selan-ai-whatileaked?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/selan-ai-whatileaked?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/selan-ai-whatileaked/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/selan-ai-whatileaked.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

selan-ai. (2026). whatileaked security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/selan-ai-whatileaked/audits/1

BibTeX 인용

@techreport{selan-ai-selan-ai-whatileaked-2026,
  author = {selan-ai},
  title = {whatileaked security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/selan-ai-whatileaked/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "whatileaked security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "selan-ai"
date-released: "2026-08-30"
url: "https://skillstore.io/skills/selan-ai-whatileaked/audits/1"
identifiers:
  - type: other
    value: "skillstore:selan-ai-whatileaked:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Audit a developer workstation

Find credentials retained in local coding-agent histories before sharing or transferring a machine.

Investigate a credential exposure

Identify affected projects, files, and repeated appearances during incident response.

Prepare managed devices for reassignment

Review agent history findings and plan credential rotation before approved cleanup.

이 프롬프트를 사용해 보세요

Run a basic scan

Check whether whatileaked is available, then scan my local supported agent histories. Do not install anything without asking.

Explain scan findings

Review the whatileaked results and explain which findings appear real, which may be fixtures, and which credentials need rotation.

Build an incident response plan

Use the scan results to create a prioritized rotation and cleanup plan. Group repeated fingerprints as the same credential.

Plan controlled cleanup

Review every file that the wipe operation would change. Proceed only after my explicit request and never answer its confirmation prompt automatically.

모범 사례

Rotate confirmed credentials before deleting local copies.
Review masked context and repeated fingerprints before classifying findings.
Require explicit approval for installation and every destructive cleanup action.

피하기

Do not treat local deletion as credential revocation.
Do not paste raw credentials into follow-up prompts or reports.
Do not automate or bypass the wipe confirmation prompt.

자주 묻는 질문

Does the scan change my files?

No. The documented scan operation only reads files.

Does the output reveal my credentials?

The skill states that results use masked context and one-way fingerprints instead of raw credential values.

What does a matching fingerprint mean?

Matching fingerprints indicate that the same credential appeared in multiple locations.

Can deleting local history recover a leaked credential?

No. Rotate the credential because deleting local data does not remove copies already sent to a provider.

Why might a finding be harmless?

Some findings are test fixtures or known examples. Review the masked context before deciding.

Is the wipe operation reversible?

No. It rewrites listed files in place and requires explicit user initiation plus typed confirmation.

개발자 세부 정보

작성자

selan-ai

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/selan-ai/whatileaked/tree/d264249417f1db8624f54d11ea66852ae2f825e6/skills/whatileaked

참조

f5d1008064a1cff356fa4ef081843059e09c5d5a

유지보수 최신성

2026. 8. 30.

사용량

1 다운로드 · 1 조회

파일 구조

📄 SKILL.md