feat(rules): detect labeled passwords pasted in prose

Add a scoped `labeled-password` rule for `password:`/`passwd:`/`passphrase:`
values pasted in chat — the single most common human leak, which slipped under
the generic catch-all's 16-char floor. Lower length floor (8) with a modest
entropy gate (3.0), medium severity.

- Drop `pwd` from keywords: `PWD=/home/...` from printenv dumps would be a
  systematic false positive, and paths clear the entropy gate.
- Add an optional per-rule `deny` regex in the detector to drop placeholder
  values that clear the entropy gate (`your-password` ≈ 3.24 outscores real
  weak passwords, so entropy alone can't filter it).

Also documents the `npx skills add` install path for the broom-sweep skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: digitaldrreamer

README.md

@@ -99,6 +99,14 @@ broom proxy --uninstall                 # remove the daemon *and* the env vars
 
 > Install globally (`npm install -g broomsticks`) when using this — the hook prefers the `broom` command but falls back to `npx broomsticks`, which re-resolves the package on every turn and adds noticeable latency.
 
+Want just the skill (no Stop hook)? Install it directly with [`skills`](https://github.com/obra/skills):
+
+```bash
+npx skills add digitaldrreamer/broomsticks/skills/broom-sweep
+```
+
+This adds the `broom-sweep` skill so you can invoke `/broom-sweep` on demand, without wiring up the automatic per-turn scan.
+
 ## How it works
 
 A matched secret is replaced inline with a stable, non-reversible placeholder:
@@ -123,6 +131,7 @@ Detection is a curated, gitleaks-style ruleset for high-confidence provider toke
 | Billing / SaaS | Stripe `sk_live_…`, Paddle `pdl_live_…`, Slack `xox[baprs]-…` |
 | Tokens | JWTs (`eyJ….eyJ….…`) |
 | Connection strings | `postgres://`, `mysql://`, `mongodb+srv://`, `redis://` with inline credentials |
+| Labeled passwords | `password:` / `passwd:` / `passphrase:` values pasted in prose (lower length floor; placeholder-filtered) |
 | Generic | `api_key` / `secret` / `password` / `token` assignments above an entropy threshold |
 
 </details>

src/detector.mjs

@@ -36,6 +36,7 @@ export function scanText(text, rules, extras = []) {
       const [start, end] = indices
 
       if (rule.entropy !== undefined && shannonEntropy(secret) < rule.entropy) continue
+      if (rule.deny && rule.deny.test(secret)) continue
 
       raw.push({ ruleId: rule.id, title: rule.title, severity: rule.severity, secret, start, end })
     }

src/rules.mjs

@@ -8,7 +8,11 @@
 
 /**
  * @typedef {'critical'|'high'|'medium'|'low'} Severity
- * @typedef {{ id:string, title:string, severity:Severity, pattern:RegExp, secretGroup?:number, entropy?:number }} Rule
+ * @typedef {{ id:string, title:string, severity:Severity, pattern:RegExp, secretGroup?:number, entropy?:number, deny?:RegExp }} Rule
+ *
+ * `deny` (optional): if the captured secret matches this RegExp in full, the
+ * match is discarded. Used to drop well-known placeholder values that clear the
+ * entropy gate (e.g. `your-password`).
  */
 
 /**
@@ -235,6 +239,32 @@ export const RULES = [
     secretGroup: 1,
   },
 
+  // ── Labeled password in prose (scoped, low floor) ─────────────────────────
+  // Pasting a credential as "Password: <value>" is the single most common human
+  // leak, and it slips under the generic rule's 16-char floor. Here the label
+  // itself is the signal, so we run a lower length floor (8) with only a modest
+  // entropy gate (3.0) — enough to drop fixed-char placeholders (xxxxxxxx → 0
+  // bits) but not to require token-grade randomness.
+  //
+  // `pwd` is deliberately NOT a keyword: transcripts routinely contain
+  // `printenv`/`env` output, and `PWD=/home/...` (a path that clears the entropy
+  // gate) would be a systematic false positive. `password|passwd|passphrase`
+  // only.
+  //
+  // Genuinely weak human passwords (changeme ≈ 2.75, hunter2 ≈ 2.81) are left
+  // uncaught on purpose: they sit in the same entropy band as — and below —
+  // common placeholders (your-password ≈ 3.24), so no threshold separates them.
+  // The `deny` list removes the placeholder strings that do clear the gate.
+  {
+    id: 'labeled-password',
+    title: 'Labeled password or passphrase',
+    severity: 'medium',
+    pattern: /\b(?:password|passwd|passphrase)\s*[:=]\s*["']?([A-Za-z0-9+/=_\-!@#$%^&*]{8,128})["']?/gid,
+    secretGroup: 1,
+    entropy: 3,
+    deny: /^(?:your[-_]?password(?:[-_]?here)?|password\d*|examplepassword|example|placeholder|changeme\d*|redacted|<.*>|\*+|x+)$/i,
+  },
+
   // ── Generic secret assignment (entropy-gated, runs last) ─────────────────
   // Catches unknown key formats assigned to recognisably secret-named variables.
   // Only fires when the value's Shannon entropy ≥ 3.5 bits/char, which eliminates

test/detector.test.mjs

@@ -30,6 +30,8 @@ const SAMPLES = {
     'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U',
   'db-url': 'postgres://admin:s3cr3tP4ss@db.example.com:5432/app',
   'generic-secret': 'api_key = "aZ9xK2mQ7wL4pR8vT1nY6bC3dE5fG0hJ"',
+  // 15-char value: under the generic rule's 16-char floor, caught by the label.
+  'labeled-password': 'Root password: uG9p3EqZ7mK1nZ2',
 }
 
 for (const [ruleId, sample] of Object.entries(SAMPLES)) {
@@ -67,12 +69,22 @@ test('decoys do not match any rule', () => {
     'See commit 1234567890abcdef1234567890abcdef12345678 for details', // bare sha
     'Connect to https://example.com/path?q=1',  // url, no inline credentials
     'const timeout = 30000',
+    'PWD=/home/user/Documents/Projects/broomsticks', // env dump: not a `pwd` keyword
+    'password: your-password',                  // placeholder cleared by deny list
+    'Password: <redacted>',                     // angle-bracket placeholder
   ]
   for (const d of decoys) {
     assert.deepEqual([...ruleIds(d)], [], `unexpected match in decoy: ${d}`)
   }
 })
 
+test('labeled-password: catches a labeled value under the generic 16-char floor', () => {
+  // The reported leak: a 15-char credential the entropy catch-all missed on length.
+  const ids = ruleIds('Root password: uG9p3EqZ7mK1nZ2')
+  assert.ok(ids.has('labeled-password'), 'expected labeled-password to fire')
+  assert.ok(!ids.has('generic-secret'), 'generic rule should not fire below 16 chars')
+})
+
 test('overlapping matches resolve to a single non-nested finding', () => {
   // A db-url that also contains an assignment-shaped substring should yield
   // exactly one finding covering the URL, not two overlapping spans.