---
name: audit-secrets-diff
description: Use when checking staged git changes for leaked credentials, API keys, tokens, or hardcoded secrets before committing — scans only the lines being added in the current diff, not the full project.
metadata:
  category: Security & Maintenance
---

# Skill: audit-secrets-diff

## Overview

Runs `git diff --cached` to extract staged additions, then scans only those lines for secrets. Use before committing — faster and more focused than `/audit-secrets` (full project scan).

## Steps

### 1. Verify staged changes exist

```bash
git diff --cached --stat
```

If empty: tell the user "No staged changes. Run `git add <files>` first, or use `/audit-secrets` to scan the full project."

### 2. Extract diff

```bash
git diff --cached
```

### 3. Dispatch scan agent

```
Agent({
  subagent_type: "humand-frontend-sandbox:diff-secret-scanner",
  prompt: "Scan this git diff for leaked secrets:\n\n{diffOutput}"
})
```

### 4. Apply remediation framework

| Finding type | Immediate action | Long-term fix |
|---|---|---|
| Key hardcoded in `src/` | Rotate credential immediately | Move to `.env`, read via `import.meta.env` |
| Key in config file | Rotate immediately | Remove from source — use backend/edge function |
| `SERVICE_ROLE_KEY` anywhere in frontend | Rotate + remove entirely | Service-role keys belong only in server-side environments |
| Secret in `public/` | Rotate + delete the file | Never put credentials in `public/` — world-readable |
| Token in `.npmrc` | Rotate (npm + GitHub) | Add `.npmrc` to `.gitignore`, inject via CI env vars |
| Key in `.env` | Verify `.env` is in `.gitignore` | Create `.env.example` with placeholder values |

### 5. Outcome

**CRITICAL findings present:**
> "Unstage the affected files with `git restore --staged <file>` before committing."

**No findings:**
> "No secrets found in staged changes. Safe to commit."
