garmin-coach-mcp: Skill for Claude Code

Repository hygiene

This repository is public. Everything committed is world-readable and, once pushed, should be assumed permanently archived somewhere.

Two different problems

Most scanners look only for the first, and this project's actual leak was the second.

Credentials — an Entra client secret, a JWT, an Azure storage key, a connection string, a private key, an assigned SECRET=… value. Consequence: someone else gets in.

Personal data — a real username in a path, an absolute path into someone's checkout, a real resource group or region, a tenant/subscription/client/object GUID, a Container Apps FQDN, an email, a real credential expiry date. Consequence: the author is identified and their infrastructure is named. No login is granted, but none of it helps a reader either.

Run this

python scripts/check_secrets.py

Blocks on both classes. It runs as a pre-commit hook (enabled by python scripts/install_hooks.py, which setup_local.py calls) and in CI, so it is not the only line of defence — but run it before proposing a commit anyway.

It fails closed: outside a git repository, or with git missing, it exits non-zero rather than reporting "0 files, all clear".

Writing docs without leaking

• Use <placeholder> for anything environment-specific: <azure-region>, <subscription-id>, <app>.
• Prefer a command that derives the value: -g $(azd env get-value AZURE_RESOURCE_GROUP) beats a real group name.
• In code, derive paths from scripts/_common.py:repo_root() or sys.prefix. Never write an absolute path into a string — including inside an error message, which is where one of these was previously hiding and being returned to remote callers.
• Never state a credential expiry date. doctor.py --remote reads the real one from Microsoft Graph.

When a match is a false positive

Add a per-line pragma, so the exception is visible in the diff and has to be justified:

TENANT = "11111111-2222-3333-4444-555555555555"  # check-secrets: allow personal