- Strip trailing .,;:!) from captured key values so mid-sentence
pastes like "MESHY_API_KEY=abc123." save correctly
- Anchor all .env grep checks with ^KEY=. to avoid matching comments
or empty assignments
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Skip placeholder values (your-key-here, <key>, etc.) so example
text from skill prompts is never saved as a real secret
- Auto-append .env to the target project's .gitignore when saving keys
- Make additionalContext provider-agnostic (remove hardcoded meshy ref)
- Use `set -a; . .env; set +a` instead of `source .env` so vars are
exported to child processes (node, npx)
- Fix grep/cut command in game-deploy to anchor match and preserve
keys containing = characters
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
API keys pasted in chat previously ended up in Claude's context window.
This adds a UserPromptSubmit hook that detects key patterns, saves them
to .env, and blocks the message so keys never reach the model.
- Add scripts/intercept-api-key.mjs (zero deps, explicit + bare key detection)
- Add hooks.UserPromptSubmit config to settings.json
- Add .env to .gitignore
- Update 6 skill prompts to use KEY=value paste format with .env check-first
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
rshtirmer