fix: make diagnosing-bugs redact secrets

fix: make diagnosing-bugs redact secrets A Snyk audit (W007, HIGH) flagged the skill for insecure credential handling: it tells the agent to "paste the invocation and its output", builds curl loops, and collects artifacts — three paths by which a live token can end up reproduced in the agent's response. Add a Redact section making redaction the first move on each, and point the two call sites at it. Warn in the HITL template that `capture` prints its value back to the terminal, where the agent reads it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

What happened

The diagnosing-bugs skill was updated to include a Redact section, which ensures sensitive data is redacted before it can be processed or displayed. This change was prompted by an identified security vulnerability related to how credentials were handled in agent responses.

Why it matters

This update enhances security for developers by preventing potential exposure of sensitive information, thereby fostering safer usage of the diagnosing-bugs skill in projects. Proper credential handling is crucial for maintaining trust and compliance in software development.

Sources