feat: review Gustavo and Marcos submitted skills

2026-09-04 09:07:54 -03:00
parent 6ccc692759
commit 76d83c9cf9
38 changed files with 2749 additions and 6 deletions
@@ -0,0 +1,52 @@
+# Secrets and PII
+
+A draft that contains any of the patterns below is **BLOCKED** by the
+`page-reviewer` skill. Scrub before posting; the reviewer's verdict is not
+overridden by "this is a test fixture" or "this is obvious from context".
+
+## Hard blocks
+
+| Pattern | Example | Action |
+|---------|---------|--------|
+| AWS access key id | `AKIA[0-9A-Z]{16}` | Replace with `<AWS_KEY>` |
+| AWS secret access key | `[A-Za-z0-9/+=]{40}` in env files | Replace with `<AWS_SECRET>` |
+| Bearer / personal token | `ghp_…`, `glpat-…`, `dapi…` | Replace with `<TOKEN>` |
+| Confluence / Jira token | `ATATT…` (Cloud), long base64 | Replace with `<CONFLUENCE_TOKEN>` |
+| Slack token | `xoxb-…`, `xoxp-…` | Replace with `<SLACK_TOKEN>` |
+| OpenAI key | `sk-…` (40+ chars after) | Replace with `<OPENAI_KEY>` |
+| Service-account password | any string in `*.password=…`, `secret: …` | Replace |
+| PEM private key | `-----BEGIN … PRIVATE KEY-----` | Replace |
+| Cookie value | `connect.sid=…`, `JSESSIONID=…` | Replace |
+
+## Soft blocks (review)
+
+| Pattern | Why | Action |
+|---------|-----|--------|
+| Customer email | PII | Mask: `j***@example.com` or remove |
+| Customer hostname / IP | PII + internal info | Replace with `<HOST>` / `<IP>` |
+| Runbook hostname (`*.k8s.sdntest.netcracker.com`) | Internal surface | Use the public URL or `<INTERNAL_HOST>` |
+| Phone number | PII | Mask or remove |
+| Bank / payment info | PII | Remove |
+
+## Why this is in the skill
+
+BASS Confluence is private to Netcracker, but watchers, exported PDFs, and
+incident write-ups leak. Pages are also exported to training data when teams
+mirror content into LLMs. "It's on a private space" is not enough.
+
+## If you need a realistic-looking fixture
+
+Generate one with the project's placeholder vocabulary:
+
+- emails: `user1@example.com`, `user2@example.com`
+- IPs: `10.0.0.1`, `192.0.2.1`
+- tokens: `<TOKEN>`, `<SECRET>`
+- hostnames: `host-a.internal`, `host-b.internal`
+
+Do not use the customer's name, the production hostname, or a real-looking
+token "because it doesn't matter".
+
+## What the reviewer checks
+
+The `page-reviewer` skill runs a grep pass against this list. A single hit
+returns **BLOCK**; the author fixes the draft and re-runs.