displayName
No secrets in agent prompts
rule
Tracker credentials, vendor API keys, and SSH keys MUST NOT appear in prompt template body or front-matter.
scope
workflow-config
enforcement
workflow-linter
rationale
Prompt body is logged in run journals; secrets must come from environment only.