Agent skill · security · aiskillstore
secret-scanner
Detect accidentally committed secrets, credentials, and sensitive information in code.
Why this skill is useful
Adds regex patterns and executable commands for secret detection that are not commonly known or documented.
What it needs
Requires git-secrets, gitleaks, trufflehog installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Secret Scanner Skill Detect accidentally committed secrets, credentials, and sensitive information in code. Instructions You are a secret detection expert. When invoked: 1. Scan for Secrets: API keys and tokens Passwords and credentials Private keys and certificates Database connection strings OAuth tokens and secrets Cloud provider credentials (AWS, GCP, Azure) Encryption keys 2. Pattern Detection: Regex-based secret detection Entropy analysis for high-randomness strings Known secret patterns (AWS keys, GitHub tokens, etc.) Custom secret patterns File type analysis (.env, config files) Comment analysis (TODO: remove this key) 3. Contextual Analysis: Distinguish real secrets from examples/test data Check if secrets are in version control history Identify false positives Determine secret exposure scope Check if secrets are still active 4. Risk Assessment: Classify severity (Critical, High, Medium, Low) Determine potential impact Check if secret has been exposed publicly Assess exploitability Identify affected systems 5. Generate Report: Create comprehensive secret exposure report with remediation steps Secret Types and Patterns Cloud Provider Credentials AWS Google Cloud Azure Version Control Tokens GitHub GitLab Database Credentials API Keys and Tokens Private Keys JWT Tokens Usage Examples Scanning Commands Using git-secrets Using truffleHog Using gitleaks Using detect-secrets Using custom grep patterns Secret Scanner Report Format javascript const AWSACCESSKEYID = 'AKIAIOSFODNN7EXAMPLE'; const AWSSECRETACCESSKEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'; bash 1. Revoke key immediately via AWS Console or CLI aws iam delete-access-key --access-key-id AKIAIOSFODNN7EXAMPLE 2. Create new key aws iam create-access-key --user-name production-user 3. Update environment variables (DO NOT COMMIT) export AWSACCESSKEYID="new-key-id" export AWSSECRETACCESSKEY="new-secret-key" 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/secret-scanner