mirror of
https://github.com/auth0/agent-skills.git
synced 2026-09-19 02:38:28 +08:00
Bharath Natarajan
6177b7e63d
Two clear rules: 1. Never retrieve/parse client_secret from CLI output unless user explicitly asked — secret access is user-driven. 2. Write-only .env — append if exists, auto-add to .gitignore, never read (avoids exposing existing secrets in context). Patterns adopted from auth0-mcp-server#94: - Append behavior (preserve existing file content) - Auto .gitignore for target file - Agent never retrieves secrets it wasn't given