Agent skill · security · github
secret-scanning
Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.
Why this skill is useful
Provides specific procedures and configurations for GitHub secret scanning that the AI wouldn't reliably generate on its own.
What it needs
Requires github account access. About 5k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Secret Scanning This skill provides procedural guidance for configuring GitHub secret scanning — detecting leaked credentials, preventing secret pushes, defining custom patterns, and managing alerts. When to Use This Skill Use this skill when the request involves: Enabling or configuring secret scanning for a repository or organization Setting up push protection to block secrets before they reach the repository Defining custom secret patterns with regular expressions Resolving a blocked push from the command line Triaging, dismissing, or remediating secret scanning alerts Configuring delegated bypass for push protection Excluding directories from secret scanning via secretscanning.yml Understanding alert types (user, partner, push protection) Enabling validity checks or extended metadata checks Scanning local code changes for secrets before committing (via MCP / AI coding agent) — see the Pre-Commit Scanning via AI Coding Agents section below for the recommended plugin How Secret Scanning Works Secret scanning automatically detects exposed credentials across: Entire Git history on all branches Issue descriptions, comments, and titles (open and closed) Pull request titles, descriptions, and comments GitHub Discussions titles, descriptions, and comments Wikis and secret gists Availability Repository Type Availability --- --- Public repos Automatic, free Private/internal (org-owned) Requires GitHub Secret Protection on Team/Enterprise Cloud User-owned Enterprise Cloud with Enterprise Managed Users Core Workflow — Enable Secret Scanning Step 1: Enable Secret Protection 1. Navigate to repository Settings → Advanced Security 2. Click Enable next to "Secret Protection" 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/secret-scanning