SKILL.md
/harden — Oracle Governance Audit
Sharp instruments need safe sheaths. The Whetstone hardens what it sharpens.
Audit an Oracle's configuration for safety, governance compliance, and operational hardening. Catches misconfigurations before they become incidents.
Usage
/harden # Quick audit — check all, report issues
/harden --full # Deep audit — check all + suggest fixes
/harden --secrets # Secrets scan only — .env, keys, tokens
/harden --rules # Golden rules compliance check
/harden --fix # Auto-fix safe issues (with confirmation)
Step 0: Detect Oracle Root
date "+🕐 %H:%M %Z (%A %d %B %Y)" && ORACLE_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
if [ -n "$ORACLE_ROOT" ] && [ -f "$ORACLE_ROOT/CLAUDE.md" ] && { [ -d "$ORACLE_ROOT/ψ" ] || [ -L "$ORACLE_ROOT/ψ" ]; }; then
PSI="$ORACLE_ROOT/ψ"
echo "✅ Oracle root: $ORACLE_ROOT"
else
echo "❌ Not in an oracle repo. /harden requires CLAUDE.md + ψ/ directory."
exit 1
fi
Step 1: Secrets Scan
Check for leaked secrets in tracked files:
# Check for common secret patterns in git-tracked files
cd "$ORACLE_ROOT"
echo "🔍 Scanning for secrets..."
# .env files that shouldn't be tracked
git ls-files | grep -E '\.env($|\.)' | grep -v '\.example' | while read f; do
echo "🚨 CRITICAL: $f is tracked by git!"
done
# Common secret patterns in tracked files (excluding binary)
git ls-files | xargs grep -l -E '(PRIVATE_KEY|API_KEY|SECRET_KEY|password|token|Bearer [a-zA-Z0-9]|sk-[a-zA-Z0-9]{20,})' 2>/dev/null | grep -v -E '(node_modules|\.lock|SKILL\.md|CLAUDE\.md)' | while read f; do
echo "⚠️ Possible secret in: $f"
done
.gitignore Checks
# Essential ignores for oracle repos
MISSING_IGNORES=""
for pattern in ".env" "node_modules/" ".DS_Store" "ψ/active/" "ψ/memory/logs/"; do
if ! grep -qF "$pattern" "$ORACLE_ROOT/.gitignore" 2>/dev/null; then
MISSING_IGNORES="$MISSING_IGNORES\n ❌ Missing: $pattern"
fi
done
if [ -n "$MISSING_IGNORES" ]; then
echo "📋 .gitignore gaps:$MISSING_IGNORES"
else
echo "✅ .gitignore covers essentials"
fi