Secrets live in an env / secret store — never in Bot description, skills, routines, AGENTS.md, or a chat paste. On an agent-ops desk that means API keys, tokens, cookies, webhook secrets, and payment credentials stay off every chat surface; the Bot injects them at runtime (or the human does) and redacts them from logs. Pair this with approval gates (stop before send / publish / pay) so a leaked chat doesn’t also leave the box. Env var names are fine in docs; values are not. If a specialist needs access to finish a job, the job text names the env var, not the value.
Who this is for
Solo founders and small ops desks already in Cursor + Grok Bot who keep pasting tokens into Bot text “just for this run.” If your pain is “the key showed up in a skill / mcp.json / chat thread,” this is the desk runbook habit — not a scare piece. Seat templates and stop language: Grok Bot role templates that stop before send/publish/pay. Lead coordination: What is a Lead Bot in a Grok Bot group?.
What counts as a secret on an agent-ops desk
Treat anything that grants access or spends money as a secret:
| Kind | Examples (names only — never paste values) |
|---|---|
| API keys / tokens | Provider API keys, personal access tokens, bot tokens |
| OAuth client material | `CLIENT_SECRET`, refresh tokens; treat static `CLIENT_ID` carefully when the file is published |
| Session / cookie material | Browser session cookies, signed-in app cookies |
| Webhook / signing secrets | Stripe webhook secrets, HMAC keys |
| Payment credentials | Card numbers, Stripe secret keys, payout credentials |
Env var names are fine in docs (`STRIPE_SECRET_KEY`, `GITHUB_TOKEN`). Values are not. Prefer “set `TOKEN_ENV` in your secret store” over inventing placeholder blobs in public posts.
Allowed surfaces vs forbidden surfaces
| Surface | Secrets? | Why |
|---|---|---|
| Env / secret store / OS keychain | Yes — only here | Runtime inject; not copied into prompts |
| Local private config (gitignored, not published) | Yes, with care | Still prefer env refs over inline values |
| Bot description | Never | Shared, logged, often re-pasted into other seats |
| Skill / role template | Never | Reused across jobs; easy to commit or share |
| Routine config | Never | Schedules work; must not carry credentials |
| `AGENTS.md` / repo agent files | Never | Shared with every agent that reads the tree |
| Chat paste / screenshots / failure cards with live values | Never | Threads get forwarded; screenshots get screenshotted |
| Published `mcp.json` / docs / blog | Never | Public forever; use env refs or omit |
If a specialist needs a credential to finish a job, the human (or a sanctioned secret tool) supplies it at runtime — the job text names the env var, not the value.
Ops pattern: inject · redact · scrub
Three habits, boring on purpose:
- Inject at runtime — Bot / MCP / shell reads from env or a secret store. Descriptions and skills say *which* var to use, never the value.
- Redact in logs — Treat tool output and failure cards as public. Replace values with `[REDACTED]` or the var name before a specialist files a review pack.
- Scrub templates before share — Before you export a skill, role pack, or `mcp.json` example, search for key-shaped strings and strip them. Publish shapes, not credentials.
For remote MCP Connect, static `CLIENT_ID` paths are a real pattern — but a published `mcp.json` must not carry secrets. Keep client secret material in env; document the field names only. Companion pillar: Build a remote MCP server with OAuth that Cursor and Claude can both Connect to.
Pair with approval gates
Secret-free chat and stop-before-send are the same desk hygiene:
- A leaked Bot description without secrets is embarrassing; a leaked description with a Stripe key is an incident.
- Approval gates (never auto-send / publish / pay) mean even if chat history escapes, the Bot still couldn’t leave the box alone.
- Lead + specialist desks keep credentials out of handoff text the same way they keep outbound sends behind a human gate — see Lead Bot in a Grok Bot group and the stop list in role templates….
Put both rules in the Bot description in plain language: no secrets in this text, and stop before send / publish / pay.
Failure card (pin this)
| Symptom | Likely cause | Fix |
|---|---|---|
| Key / token appears in chat | Pasted “just for this run” into prompt or Bot text | Rotate the credential; move to env; scrub the thread/description |
| Secret committed in `mcp.json` or skill | Example copied with a live value | Rotate; gitignore / purge history if needed; republish placeholder-only shape |
| Specialist “helps” by pasting a token into a skill | Job asked for access instead of an artifact | Job = reviewable file; human injects secret at runtime |
| Webhook secret in a failure card screenshot | Log dump included raw headers/body | Redact before filing; teach specialists env-name-only cards |
| `AGENTS.md` contains API keys | Repo agents treated as a secret store | Strip; document var names only; store values in env / CI secrets |
| Payment creds in a routine | Routine treated as permission + vault | Routines schedule drafts; secrets stay in env; pay stays human-gated |
Debug order: find where the value was pasted → rotate → move to env / secret store → scrub every chat surface (description, skill, routine, `AGENTS.md`, committed configs) → confirm approval stops still hold.
What Cheat Sheet + Agent Starter are for
The Cheat Sheet is the skimmable gate / safety checklist mindset for this desk — roster, approval card, and “secrets stay in env” hygiene in one pocket reference. Soft path today: start on /free (Harness Desk Starter — seat, done-artifact skill, gate card). When you want harness depth (role pack + agent-ops files with the same contract), use the Agent Starter Kit ($47).
Stay in agent-ops — never Domo-as-kit-ROI, never scare metrics, never example posts that include real-looking secrets.
Soft next step
Move one live credential out of chat surfaces today — Bot description, skill, or `AGENTS.md` — into env / secret store, then rotate it. Soft ladder: /free for the starter desk, Cheat Sheet for the gate/safety checklist mindset, then the Agent Starter Kit ($47) when you want the harness pack. No rush — ship the “secrets stay in env” line into your own runbook either way.