About

Imported from cyberful/cyberful (cyberful/builtin/skills/trace-secret-propagation/SKILL.md). Install upstream with npx skills add cyberful/cyberful --skill trace-secret-propagation. Copyright stays with the author.

Trace Secret Propagation

Name: trace-secret-propagation
Author: cyberful

Trace digests, not plaintext. Start from engagement-supplied SHA-256 fingerprints and bounded JSON snapshots; never copy a discovered credential into the request or evidence artifact.

Stage scripts/trace_secret_propagation.py, its manifest, and the example. The analyzer is offline, opens only confined regular JSON files, starts no child process, and emits deterministic occurrence and lifecycle evidence under the output schema.

Read secret-propagation-method.md before interpreting an occurrence or absence. A missing digest can mean transformation or incomplete evidence, not successful cleanup.

Interpret the trace

Compare every occurrence against the marker's allowed artifact and JSON-pointer prefixes. Correlate first/last observations, rotation epoch, deployment version, revocation, and cleanup evidence. Report plaintext exposure only when the source artifact itself establishes it; the helper intentionally records only digests and pointers.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberful-cyberful-trace-secret-propagation/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberful-cyberful-trace-secret-propagation.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberful-cyberful-trace-secret-propagation",
  "kind": "skill",
  "name": "trace-secret-propagation",
  "description": "Trace secret fingerprints through bounded offline configuration, deployment, log, and runtime snapshots to identify allowed placement, unexpected propagation, stale copies, and cleanup gaps without emitting secret values.",
  "publisher": "cyberful",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "secrets",
      "credentials",
      "propagation",
      "fingerprints",
      "offline-analysis",
      "lifecycle",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Trace secret fingerprints through bounded offline configuration, deployment, log, and runtime snapshots to identify allowed placement, unexpected propagation, stale copies, and cleanup gaps without emitting secret values."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/cyberful/cyberful",
      "path": "cyberful/builtin/skills/trace-secret-propagation/SKILL.md",
      "ref": "ec598a6d48580f997cdd00766692493df7390e16",
      "url": "https://github.com/cyberful/cyberful/blob/ec598a6d48580f997cdd00766692493df7390e16/cyberful/builtin/skills/trace-secret-propagation/SKILL.md",
      "key": "cyberful/cyberful/cyberful/builtin/skills/trace-secret-propagation/SKILL.md"
    }
  },
  "instructions": "# Trace Secret Propagation\n\nTrace digests, not plaintext. Start from engagement-supplied SHA-256 fingerprints and bounded JSON snapshots; never copy a discovered credential into the request or evidence artifact.\n\nStage [scripts/trace_secret_propagation.py](scripts/trace_secret_propagation.py), its [manifest](scripts/manifest.json), and the [example](assets/secret-propagation-input.example.json). The analyzer is offline, opens only confined regular JSON files, starts no child process, and emits deterministic occurrence and lifecycle evidence under the [output schema](assets/secret-propagation-e",
  "cost": {
    "context_tokens": 298
  }
}

Fetch it by URL: GET /api/v1/registry/cyberful-cyberful-trace-secret-propagation/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.