Agent skill · security · jeremylongshore
scanning-for-secrets
Detect exposed secrets, API keys, and credentials in code. Use when auditing
Why this skill is useful
Adds specific pattern matching and entropy analysis techniques for detecting exposed secrets that the AI wouldn't reliably generate on its own.
What it needs
Requires security scanning tools installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Secret Scanner Detect exposed API keys, passwords, tokens, and private keys in source code using pattern matching and entropy analysis, with remediation guidance for each finding. Overview scan your codebase for exposed secrets, API keys, passwords, and other sensitive credentials. It helps you identify and remediate potential security vulnerabilities before they are committed or deployed. How It Works 1. Initiate Scan: Claude activates the secret-scanner plugin. 2. Codebase Analysis: The plugin scans the codebase using pattern matching and entropy analysis. 3. Report Generation: A detailed report is generated, highlighting identified secrets, their locations, and suggested remediation steps. When to Use This Skill This skill activates when you need to: Scan your codebase for exposed API keys (e.g., AWS, Google, Azure). Check for hardcoded passwords in configuration files. Identify potential private keys (SSH, PGP) accidentally committed to the repository. Proactively find secrets before committing changes. Examples Example 1: Identifying Exposed AWS Keys User request: "Scan for AWS keys in the codebase" The skill will: 1. Activate the secret-scanner plugin. 2. Scan the codebase for patterns matching AWS Access Keys (AKIA[0-9A-Z]{16}). 3. Generate a report listing any found keys, their file locations, and remediation steps (e.g., revoking the key). Example 2: Checking for Hardcoded Passwords User request: "Check for exposed credentials in config files" The skill will: 1. Activate the secret-scanner plugin. 2. Scan configuration files (e.g., database.yml, .env) for password patterns. 3. Generate a report detailing any found passwords and suggesting the use of environment variables. Best Practices Regular Scanning: Schedule regular scans to catch newly introduced secrets. Pre-Commit Hooks: Integrate the secret-scanner into your pre-commit hooks to prevent committing secrets. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/scanning-for-secrets--647bad