Defame1297
925f04acdb
validate-secrets.sh checked the placeholder allowlist regex against the whole line before running any secret-pattern regex. An unrelated placeholder-looking token anywhere on the line (e.g. "example" or "your-token-here" in a trailing comment) suppressed detection of a real credential earlier on the same line. Scope the allowlist check to the matched secret-candidate substring only, which the per-match re-check already did downstream but the whole-line pre-check short-circuited before it ever ran. Extend validate-secrets.bats with a case proving a real AWS-style key is still caught when a placeholder token sits elsewhere on the line. Regenerate the flat-mirror copy at plugins/core/skills/agentsmd-audit/scripts/validate-secrets.sh via scripts/sync-plugin-content.sh --all per ADR-0016.
scripts/
Deterministic validators this skill shells out to instead of relying on LLM judgment for mechanical checks.
| File | Purpose |
|---|---|
validate-secrets.sh |
Scans every AGENTS.md file (root + nested) for embedded secrets, API keys, tokens, and connection strings |
validate-structure.sh |
Checks for empty/placeholder content, the common-sections checklist, and nested-vs-root duplication |
validate-drift.sh |
Resolves referenced npm/make commands and file paths against the actual repo state |
All three take a single <repo-root> argument, print FAIL/INFO/SUGGESTION findings to stdout, and exit non-zero only on FAIL.