Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent YAML helper, but it automatically stores and reuses local project/device metadata across sessions and shared skill files without asking first.
Install only if you are comfortable with this skill keeping local notes about your YAML projects and sharing selected project/device metadata with other Clawic skill boxes. It has strong secret-redaction rules and no network exfiltration evidence, but users who do not want automatic cross-session memory should disable or clear its ~/Clawic/data/yaml/, ~/Clawic/data/projects/, and ~/Clawic/data/devices/ records.
SKILL.md:34Automatic Persistent Profiling and Cross-Skill File Access Without Explicit Consent
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Entities that belong to other skills stay in their shared box.** A device configured through YAML (Home Assistant, netplan, cloud-init, ESPHome) goes to `~/Clawic/data/devices/devices.md`, not here. A config decision that belongs to tracked work goes to `~/Clawic/data/projects/<project>.md`, and this box keeps only its name as a pointer. Protocol for both is in `memory-template.md`: read before adding, update your own row in place, never a second row for the same entity.
**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in YAML the user pastes in to be saved. Strip the value, store the pointer: `env:DB_PASSWORD`, `keychain:prod-tls`, `1password:Work/Cluster/kubeconfig`, `sops:secrets/prod.enc.yaml`, `file:~/.kube/config`. A pasted PEM key inside a `|` block is the single most common way a secret lands in a memory file — it goes in as `<file:~/.ssh/id_ed25519>`, never as text. If data sits at an old location (`~/yaml/` or `~/clawic/yaml/`), move it to `~/Clawic/data/yaml/`, and say in one line that you moved it and from where.
YAML never fails loudly at the moment you make the mistake: it produces a *valid document with the wrong types*, and the error surfaces three layers away as `cannot unmarshal number into string`. So the job is always the same — name which of five things the file is doing (a scalar being resolved, indentation defining scope, a block scalar folding, an anchor being expanded, or a tag being constructed), then quote, indent, or pin so the answer stops depending on the parser. Work from defaults immediately: never open with questions about their linter, their spec version, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` → the Configuration table default.
Referenced artifact was not completely inspected
| GitHub Actions, GitLab CI, CircleCI, Azure Pipelines | `on:` truthiness, `${{ }}` quoting, `extends` vs anchors across includes | `pipelines.md` |
Referenced artifact was not completely inspected
| GitHub Actions, GitLab CI, CircleCI, Azure Pipelines | `on:` truthiness, `${{ }}` quoting, `extends` vs anchors across includes | `pipelines.md` |
Referenced artifact was not completely inspected
| Ansible, Compose, CloudFormation, OpenAPI, Home Assistant, cloud-init | Per-tool tags, templating layers, and the quoting each one demands | `dialects.md` |
Referenced artifact was not completely inspected
| Ansible, Compose, CloudFormation, OpenAPI, Home Assistant, cloud-init | Per-tool tags, templating layers, and the quoting each one demands | `dialects.md` |
Referenced artifact was not completely inspected
| Ansible, Compose, CloudFormation, OpenAPI, Home Assistant, cloud-init | Per-tool tags, templating layers, and the quoting each one demands | `dialects.md` |
Referenced artifact was not completely inspected
| Ansible, Compose, CloudFormation, OpenAPI, Home Assistant, cloud-init | Per-tool tags, templating layers, and the quoting each one demands | `dialects.md` |
Referenced artifact was not completely inspected
| Designing a new config file or an env-overlay layout | Merge semantics, null vs absent, list strategy, what belongs outside the file | `config-design.md` |
Referenced artifact was not completely inspected
| Designing a new config file or an env-overlay layout | Merge semantics, null vs absent, list strategy, what belongs outside the file | `config-design.md` |
Referenced artifact was not completely inspected
| Designing a new config file or an env-overlay layout | Merge semantics, null vs absent, list strategy, what belongs outside the file | `config-design.md` |
Referenced artifact was not completely inspected
| Designing a new config file or an env-overlay layout | Merge semantics, null vs absent, list strategy, what belongs outside the file | `config-design.md` |
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- `&name` attaches to the node that follows it — a mapping, a sequence, or a single scalar (`retries: &r 3` then `attempts: *r`).
- `*name` is a reference to the same node, not a copy. In most loaders the two names point at one object in memory; mutating one mutates the other.
- Anchor names are `[A-Za-z0-9_-]`-ish, cannot contain `[ ] { } ,`, and are re-definable: a second `&defaults` later in the file shadows the first from that point on. No warning.
- An alias must appear **after** its anchor in document order. Forward references are illegal: `found undefined alias`.
## Merge Keys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Home Assistant
- Local tags everywhere: `!include`, `!include_dir_merge_list`, `!include_dir_named`, `!secret`, `!env_var`. Only Home Assistant's own loader implements them; `yamllint` handles them (it does not construct) but a generic `safe_load` fails.
- `!secret name` reads from `secrets.yaml`, which stays out of version control. That file is the credential store — never copy its values anywhere (`security.md`).
- Entity ids are strings with dots (`sensor.living_room_temp`) and are safe unquoted; times (`06:30`) are not — quote them.
- `automation.yaml` and friends are rewritten by the UI editor, which strips every comment. Files edited in the UI must not carry comments you care about; keep hand-written config in `!include`d files the UI does not touch.
- A device configured this way belongs in the shared box: write its row to `~/Clawic/data/devices/devices.md` (protocol in `memory-template.md`), not into this skill's memory.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Home Assistant
- Local tags everywhere: `!include`, `!include_dir_merge_list`, `!include_dir_named`, `!secret`, `!env_var`. Only Home Assistant's own loader implements them; `yamllint` handles them (it does not construct) but a generic `safe_load` fails.
- `!secret name` reads from `secrets.yaml`, which stays out of version control. That file is the credential store — never copy its values anywhere (`security.md`).
- Entity ids are strings with dots (`sensor.living_room_temp`) and are safe unquoted; times (`06:30`) are not — quote them.
- `automation.yaml` and friends are rewritten by the UI editor, which strips every comment. Files edited in the UI must not carry comments you care about; keep hand-written config in `!include`d files the UI does not touch.
- A device configured this way belongs in the shared box: write its row to `~/Clawic/data/devices/devices.md` (protocol in `memory-template.md`), not into this skill's memory.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Rails, Symfony, Spring
- **Rails** `database.yml`, `secrets.yml`, locale files: ERB is allowed inside (`<%= ENV['X'] %>`) and is processed before YAML, so the file is a template. Aliases are disabled by default since Psych 4 — `YAML.load(..., aliases: true)` or `ActiveSupport`'s loader (`parsers.md`).
- Rails locale files are deep-nested maps where a missing key silently falls back — schema validation is worth it above a few hundred keys.
- **Symfony**: its own parser with `!php/const`, `!php/enum` tags and a documented subset of YAML; `%parameter%` and `@service` references are Symfony's, not YAML's — `@` at the start of a value needs quotes.
- **Spring Boot** `application.yml`: relaxed binding maps `my-prop`, `myProp` and `MY_PROP` to the same property, profiles are separated by `---` inside one file with `spring.config.activate.on-profile`, and a duplicated key across profile documents is legal and intentional. Unquoted `on`/`off` values resolve to booleans through SnakeYAML 1.1.
Detected: suspicious.exposed_secret_literal