bac2b27bb8
BREAKING CHANGES: - Remove -cskill suffix from all skill names (use standard kebab-case) - Simplify marketplace.json to only official fields (fixes Issue #5) - SKILL.md body must be <500 lines (progressive disclosure via references/) New features: - Cross-platform support for 8+ platforms (Claude Code, Copilot, Cursor, Windsurf, Cline, Codex CLI, Gemini CLI) - scripts/install-template.sh: Auto-detect platform installer with --dry-run - scripts/validate.py: Spec compliance checker for generated skills - scripts/security_scan.py: Security scanner for hardcoded keys and dangerous patterns - MIGRATION.md: v3.x to v4.0 migration guide - 6 new reference files for progressive disclosure from lean SKILL.md Key changes: - SKILL.md: 4,116 → 272 lines with spec-compliant YAML frontmatter - marketplace.json: Stripped to {name, plugins} only - article-to-prototype-cskill/ → article-to-prototype/ - stock-analyzer-cskill/ → stock-analyzer/ - Export system integrates validation + security scanning - README.md rewritten for all supported platforms - Phase 5 pipeline outputs SKILL.md-first, spec-compliant skills Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
36 lines
1.2 KiB
Markdown
36 lines
1.2 KiB
Markdown
# SC-046: Hardcoded API Key Replaced with Environment Variable Reference
|
|
|
|
> Covers: FR-013, Edge case 2.3 — Generated script contains hardcoded API key: fail scan, replace with env var, warn user
|
|
> Type: Edge Case
|
|
|
|
## Given
|
|
- During Phase 5, the generated `scripts/main.py` contains:
|
|
```python
|
|
API_KEY = "sk-abc123def456"
|
|
headers = {"Authorization": f"Bearer {API_KEY}"}
|
|
```
|
|
|
|
## When
|
|
- The security scan runs on the generated skill
|
|
|
|
## Then
|
|
- The security scan fails and identifies the hardcoded key
|
|
- The script is updated to use an environment variable:
|
|
```python
|
|
API_KEY = os.environ.get("API_KEY")
|
|
headers = {"Authorization": f"Bearer {API_KEY}"}
|
|
```
|
|
- The user is warned about the replacement
|
|
|
|
## Verification Method
|
|
|
|
**Method**: Automated test
|
|
|
|
**Steps**:
|
|
1. Generate a skill where a script would contain a hardcoded API key
|
|
2. After Phase 5 completes, read `scripts/main.py`
|
|
3. Assert the hardcoded key string `sk-abc123def456` is NOT present
|
|
4. Assert `os.environ.get` or `os.getenv` is present
|
|
5. Verify security scan output mentions the replacement
|
|
|
|
**Expected evidence**: No hardcoded key in final script. `os.environ.get("API_KEY")` is used instead. Security warning present in output.
|