> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agen.co/llms.txt
> Use this file to discover all available pages before exploring further.

# A Secret Was Found in a Skill

> What the "Secret exposed in a skill" alert and the "Secrets redacted" badge mean, what was and was not sent for review, and how to clear them.

The [Frontegg Portal](https://portal.frontegg.com) shows a **Secret exposed in a
skill** alert, and the skill, plugin, or instruction file carries a **Secrets
redacted** badge. The alert names the kind of key, the file it is in, and — for a
key of 16 characters or more — its last three characters, for example
"Supabase secret ending …xyz in SKILL.md".

## What this means

A skill, plugin, or instruction file that an AI agent loads on a managed Mac
contains a credential written into it in plain text: an API key, an access token,
a password in a URL, or an `Authorization` header copied into an example.

Before AgenShield sent the file for review, it replaced every credential it
recognized with a marker such as `[REDACTED:supabase-secret-api-key:…xyz]`. The
review saw the markers, not the keys.

The key is still in the file on the Mac, and every AI agent that loads the skill
can read it and send it anywhere the agent can reach.

## What to do

1. **Rotate the key** with the service that issued it. Assume it is known to
   anyone who had the skill, the repository it came from, or a copy of either.
2. **Remove the key from the skill.** Have the skill read the key from an
   environment variable or a secret manager instead of carrying it.
3. **Review the skill again.** Its content changed, so it is reported for review
   as a new version. The alert can be resolved once the key is rotated.

A skill with redacted secrets is never approved automatically; an administrator
reviews it. Approving it does not remove the key from the Mac.

## On AgenShield 2026.10.0 and earlier

Versions up to and including 2026.10.0 sent skill, plugin, and instruction files
for review **without** removing credentials, and raised no alert. If your
organization reviewed skills on those versions, a key written into one of them
reached your organization's review records. Rotate any key you find in a skill,
even if no alert was raised for it.

## When to escalate

Contact support if a file you know contains a key shows no badge after it is
reported again, or if the alert names a file that contains no key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.