client-secret-sweep

仓库创建 2026年7月28日最近提交 7 小时前SkillHot 收录 1 小时前

▸ 精选理由

上线前或接入第三方时快速排查前端密钥暴露风险。

这个 Skill 做什么

追踪哪些环境变量或常量被编译进前端包，检测密钥泄露。

帮你找出哪些 environment variables 或常量真的被编译进前端包，确认没有把秘密（比如 API key、token）带到浏览器里。适合上线前、添加第三方服务或新增 API key 后使用，能防止把敏感信息误发到客户端。特别之处是检查编译产物里实际包含的值，不靠变量名猜测，能定位是哪行代码或哪个文件泄露了密钥。

▸ 展开 SKILL.md 英文原文

Prove no secret reaches the browser, by tracing which environment variables and constants actually get compiled into your client bundle rather than trusting naming conventions. Use before a public launch, after adding any API key, or when wiring a third-party service into a frontend.

开发编程密钥扫描前端安全通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/sriptcollector/toolbay-skills/main/skills/client-secret-sweep/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/sriptcollector/toolbay-skills/main/skills/client-secret-sweep/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Client Secret Sweep

## Install

Save this file as `~/.claude/skills/client-secret-sweep/SKILL.md`, or
`.claude/skills/client-secret-sweep/SKILL.md` to scope it to one repo. Claude
Code auto-discovers it. Invoke with `/client-secret-sweep` or by asking "is any
secret leaking into my frontend bundle?".

## Why this exists

A secret in a client bundle is not a vulnerability you patch. It is a credential
you must rotate, because it was served to every visitor and cached by every CDN
and browser that touched it. Deleting the line does not un-publish it.

The naming conventions that are supposed to prevent this (`NEXT_PUBLIC_`,
`VITE_`, `REACT_APP_`) only protect you when the value is read thro

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有