📦

whatileaked

Name: whatileaked
Author: selan-ai

Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды🔑 Переменные окружения

Find Credentials Leaked in AI Coding Histories

AI coding histories can retain credentials after they were shared with a model provider. This skill finds affected records while keeping reported secrets masked.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "whatileaked" from https://skillstore.io/skills/selan-ai-whatileaked.md and its manifest at https://skillstore.io/api/skills/selan-ai-whatileaked/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/selan-ai-whatileaked.md Подписанный manifest GET /api/skills/selan-ai-whatileaked/manifest Подписанный lockfile GET /api/skills/selan-ai-whatileaked/lockfile

Протестировать

Использование «whatileaked». Scan my coding-agent histories for leaked credentials.

Ожидаемый результат:

The scan found two fingerprints across three files. Rotate the likely production credential before considering local cleanup.

Использование «whatileaked». Are these two findings the same credential?

Ожидаемый результат:

Yes. The matching fingerprint indicates one credential appeared in both locations, although the secret itself remains masked.

Использование «whatileaked». Help me interpret a masked test-key finding.

Ожидаемый результат:

The context suggests a test fixture rather than an active credential.
Confirm the source file and deployment use before dismissing it.
Rotate the credential if its status remains uncertain.

Аудит безопасности

Высокий риск

v1 • 30.08.2026 Открыть версионный отчет

All four static findings are false positives caused by Markdown prose and masked examples, not executable Ruby or environment access. The skill still introduces real risks by installing an external package and offering an irreversible wipe operation.

Просканировано файлов

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

SKILL.md:42-48

Irreversible Transcript Wipe

The optional wipe command rewrites files in place and cannot be undone. Explicit user initiation and typed confirmation reduce accidental activation but do not remove the impact.

The skill directly states that the command rewrites files in place and cannot be undone. It also documents the confirmation safeguards.

Средний

SKILL.md:20-26

External Package Installation and Execution

The skill can install a global npm package and then run it against local histories that may contain credentials. User approval is required, but package integrity is not pinned.

The installation command and approval requirement are explicit. The reviewed file provides no version pin or integrity verification.

Факторы риска

⚙️ Внешние команды (2)

SKILL.md:28 SKILL.md:40

🔑 Переменные окружения (1)

SKILL.md:40

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/selan-ai-whatileaked/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/selan-ai-whatileaked/security.svg)](https://skillstore.io/skills/selan-ai-whatileaked?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/selan-ai-whatileaked?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/selan-ai-whatileaked/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/selan-ai-whatileaked.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

selan-ai. (2026). whatileaked security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/selan-ai-whatileaked/audits/1

Цитата BibTeX

@techreport{selan-ai-selan-ai-whatileaked-2026,
  author = {selan-ai},
  title = {whatileaked security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/selan-ai-whatileaked/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "whatileaked security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "selan-ai"
date-released: "2026-08-30"
url: "https://skillstore.io/skills/selan-ai-whatileaked/audits/1"
identifiers:
  - type: other
    value: "skillstore:selan-ai-whatileaked:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Audit a developer workstation

Find credentials retained in local coding-agent histories before sharing or transferring a machine.

Investigate a credential exposure

Identify affected projects, files, and repeated appearances during incident response.

Prepare managed devices for reassignment

Review agent history findings and plan credential rotation before approved cleanup.

Попробуйте эти промпты

Run a basic scan

Check whether whatileaked is available, then scan my local supported agent histories. Do not install anything without asking.

Explain scan findings

Review the whatileaked results and explain which findings appear real, which may be fixtures, and which credentials need rotation.

Build an incident response plan

Use the scan results to create a prioritized rotation and cleanup plan. Group repeated fingerprints as the same credential.

Plan controlled cleanup

Review every file that the wipe operation would change. Proceed only after my explicit request and never answer its confirmation prompt automatically.

Лучшие практики

Rotate confirmed credentials before deleting local copies.
Review masked context and repeated fingerprints before classifying findings.
Require explicit approval for installation and every destructive cleanup action.

Избегать

Do not treat local deletion as credential revocation.
Do not paste raw credentials into follow-up prompts or reports.
Do not automate or bypass the wipe confirmation prompt.

Часто задаваемые вопросы

Does the scan change my files?

No. The documented scan operation only reads files.

Does the output reveal my credentials?

The skill states that results use masked context and one-way fingerprints instead of raw credential values.

What does a matching fingerprint mean?

Matching fingerprints indicate that the same credential appeared in multiple locations.

Can deleting local history recover a leaked credential?

No. Rotate the credential because deleting local data does not remove copies already sent to a provider.

Why might a finding be harmless?

Some findings are test fixtures or known examples. Review the masked context before deciding.

Is the wipe operation reversible?

No. It rewrites listed files in place and requires explicit user initiation plus typed confirmation.

Сведения для разработчиков

Автор

selan-ai

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/selan-ai/whatileaked/tree/d264249417f1db8624f54d11ea66852ae2f825e6/skills/whatileaked

Ссылка

f5d1008064a1cff356fa4ef081843059e09c5d5a

Актуальность поддержки

30.08.2026

Использование

1 загрузок · 1 просмотров

Структура файлов

📄 SKILL.md