yu1128-L a4427625cf
fix(skillscan): detect fine-grained PATs and Google API keys, scan .zsh (#6423)
- secret-cloud-token: add the github_pat_ and AIza families, matching the
  canonical PII detector.
- _is_shell_path: treat .zsh by suffix, so a missing shebang or a rename can
  no longer bypass every shell rule.
- Sync the same two patterns into _EGRESS_SECRET_PATTERNS so the IM egress
  scrubber stays in lockstep with skillscan.
- Regression tests for all of the above.

Co-authored-by: yu1128-L <296164533+yu1128-L@users.noreply.github.com>
2026-10-07 21:16:46 +08:00
..