What problem does it solve? Legacy Angular environment..ts files often contain secrets (PG merchant keys, OAuth secrets) that leak into client bundles or get reused across environments, creating security risks during frontend migration. This Skill inventories those secrets before migration phases that depend on them. ## Core Features & Use Cases - Secret Inventory: Scans legacy src/environments/.ts files and their readers in src/app/** and server.ts to catalog every secret in use. - Exposure Classification: Classifies each secret as client-bundle exposed versus server-only, and flags cross-environment reuse such as dev tests hitting production merchants. - Relocation Guidance: Emits a JSON report (docs/migration/secret-audit-report.json) with a relocation sequence, without changing code or rotating anything. - Use Case: Before migrating payment (Phase 4) or auth (Phase 5) modules, run this read-only audit to know which Kakao OAuth secrets and PG merchant keys must move server-side, with remediation tracked under OMH-477. ## Quick Start Run the fm-secret-audit skill with --app pc to inventory secrets in the legacy environment files and produce the audit report.
