From fulcrum
Never include credentials, API keys, tokens, passwords in tool inputs or memory writes. Every tool call accepting free-form text.
npx claudepluginhub moabualruz/fulcrum --plugin fulcrumThis skill uses the workspace's default tool permissions.
Never include credentials / API keys / tokens / passwords in:
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.
Automates semantic versioning and release workflow for Claude Code plugins: bumps versions in package.json, marketplace.json, plugin.json; verifies builds; creates git tags, GitHub releases, changelogs.
Never include credentials / API keys / tokens / passwords in:
Bash, Write, Edit, any MCP call).write_memory content or tags).PreToolUse hook scans inputs, denies matches (9 patterns: AWS keys, GitHub tokens, API_KEY=..., bearer tokens, private keys, Slack tokens, DB URLs with inline creds, JWTs, password=...). Denial logged as secret_redacted policy event with tool name + approx location.
DATABASE_URL=postgres://user:pass@host/db.Need secret to proceed:
fulcrum action exec block_agent_run with reason "needs secret: <NAME>" — e.g., "needs secret: STRIPE_WEBHOOK_SECRET for integration tests in packages/billing".process.env.NAME inside code — never from prompt."configured in .env.local"."secret committed: <path>" + escalate. Rotation = human decision.Bash "just to test" → hook denied, attempt logged. Do not retry.lesson memory.See also: block-when-stuck, write-memory-on-completion.