secret-handling

## Context Spawned agents have read access to the entire repository, including `.env` files containing live credentials. If an agent reads secrets and writes them to `.squad/` files (decisions, logs, history), Scribe auto-commits them to git, exposing them in remote history. This skill codifies absolute prohibitions and safe alternatives. ## Patterns ### Prohibited File Reads **NEVER read these files:** - `.env` (production secrets) - `.env.local` (local dev secrets) - `.env.production` (production environment) - `.env.development` (development environment) - `.env.staging` (staging environment) - `.env.test` (test environment with real credentials) - Any file matching `.env.*` UNLESS explicitly allowed (see below) **Allowed alternatives:** - `.env.example` (safe — contains placeholder values, no real secrets) - `.env.sample` (safe — documentation template) - `.env.template` (safe — schema/structure reference) **If you need config info:** 1. **Ask the user directly** — "What's the database connection string?" 2. **Read `.env.example`** — shows structure without exposing secrets 3. **Read documentation** — check `README.md`, `docs/`, config guides **NEVER assume you can "just peek at .env to understand the schema."** Use `.env.example` or ask. ### Prohibited Output Patterns **NEVER write these to `.squad/` files:** | Pattern Type | Examples | Regex Pattern (for scanning) | |--------------|----------|-------------------------------| | API Keys | `OPENAI_API_KEY=sk-pro...