eric/project-work
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Project-2 baseline

Browse Source
This commit is contained in:
Eric Bell
2026-10-04 21:19:23 -04:00
parent 0f04889edf
commit 213eb3c403
861 changed files with 1710 additions and 3363322 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
worker-toolkit-potion-polyglot/.claude/skills/detector-credential-leakage/core.md
View File

@@ -29,8 +29,8 @@ USER_ID=6428…[redacted]
— the author's own API key, proxy endpoint, and user identity, swept out of
their authoring container and checked into the task. Nothing about the task
needs these; the agent under test can't use them (no network); and the key is
now distributed to every downstream consumer. The same sweep brings in a `.env`
needs these; the sandbox has network access, so the agent under test could
use them; and the key is now distributed to every downstream consumer. The same sweep brings in a `.env`
symlink into the author's home directory, an `.env.bak-*` full of real
third-party secrets, or a captured HTTP request with a live bearer token.