Auth and Secrets Skill

Non-negotiables

• •Never commit secrets.
• •Never print secrets in logs/test output.
• •Prefer short-lived tokens when possible.

Implementation

• •Centralize auth header injection in the transport layer.
• •If refresh tokens exist: implement refresh with locking to avoid stampede.
• •Provide a redaction utility for logs.

Testing

• •Use env var injection locally and in CI.
• •Provide a “no-auth” negative test if the API supports it.