Agent skill · security · jeremylongshore
scanning-for-hardcoded-secrets
Scan a source-code tree for hardcoded credentials embedded in source files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens, Anthropic API keys, OpenAI keys, JWT signing secrets, generic base64-encoded passwords, RSA / SSH private keys, and high-entropy string literals that pattern-match common credential shapes. Use when: pre-commit gate before pushing a feature branch, audit before SOC2, post-incident scan after a leak, or inheriting a codebase you didn't write. Threshold: any source file contains a string that matches a canonical credential regex (AWS AKIA prefix, GitHub ghp_ prefix, etc.) OR a string with Shannon entropy above 4.5 in a field context (key=, token:, secret=). Trigger with: "scan secrets", "credential scan", "find hardcoded keys", "leak check".
Why this skill is useful
Provides domain-specific regex patterns and scanning procedures for detecting hardcoded secrets that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Scanning for Hardcoded Secrets Overview The single most common cause of credential breach in 2026 remains hardcoded secrets in source code. Engineers paste an API key into a config file "just for testing," forget to remove it, commit the file. The credential is now in the repository's history forever (git rebase doesn't help if anyone cloned in between) and extractable by anyone who reaches the repo: contractors, ex-employees, attackers via .git/ directory exposure (see skill six), GitHub bot scrapers crawling public repos. The cost of detection-after-commit is near-zero (free tools exist: gitleaks, trufflehog, this skill). The cost of detection-before-commit is also near-zero (pre-commit hooks). The cost of remediation after the fact is rotating every credential exposed + auditing for exploitation + potentially notifying customers of breach. The asymmetry is severe, the discipline is the only constraint. This skill scans a filesystem tree, matching against a canonical regex library covering the credential shapes attackers and bots search for first. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- AWS access key (AKIA-prefix) CRITICAL Literal AKIA[0-9A-Z]{16} in any file CWE-798 AWS secret access key CRITICAL 40-char base64 in awssecretaccesskey field context CWE-798 GitHub personal access token CRITICAL ghp[A-Za-z0-9]{36} or gho, ghu, ghs, ghr CWE-798 GitHub app installation token CRITICAL ghs[A-Za-z0-9]{36} CWE-798 Stripe live key CRITICAL sklive[A-Za-z0-9]{24,} CWE-798 Stripe test key MEDIUM sktest[A-Za-z0-9]{24,} CWE-798 Anthropic API key CRITICAL sk-ant-api03-[A-Za-z0-9-]{93} or similar CWE-798 OpenAI API key CRITICAL sk-(proj-)?[A-Za-z0-9-]{40,} CWE-798 Slack bot token CRITICAL xoxb-[A-Za-z0-9-]+ CWE-798 Slack user token CRITICAL xoxp-[A-Za-z0-9-]+ CWE-798 Google API key HIGH AIza[A-Za-z0-9-]{35} CWE-798 RSA / OpenSSH private key CRITICAL BEGIN PRIVATE KEY header (RSA, OPENSSH, EC, DSA variants) CWE-321 JWT secret HI …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/scanning-for-hardcoded-secrets--de2d13