Agent skill · security · kochetkov-ma
secrets-scan
Scans git-tracked files for leaked secrets. Triggers - secrets scan, find credentials, leaked keys, security audit.
Why this skill is useful
Adds a comprehensive executable script for scanning git repositories for leaked secrets with parallel processing and structured reporting.
What it needs
Requires git installed locally. About 7k tokens when loaded. Last updated 2026-08-06. 29 stars on the source repository.
What this skill does
Secrets Scan Prompt contract Position 1 of $ARGUMENTS is a free-form prompt (RU/EN) — modes and flags are optional and may follow in any order. Nobody types keys: resolve mode + scope FROM the prompt. Mode EN keywords RU keywords Mutates? ------ ------------- ------------- ---------- scan (empty), scan, check, audit, find скан, проверь, аудит, найди no fix fix, remediate, clean up, --fix почини, исправь, зафикси yes 1. Strip flags (--fix is a flag, not free text). An explicit mode token anywhere wins outright. 2. Else score modes by distinct whole-word keyword hits (table above). Highest unique score wins; tie -> scan (read-only wins). All zero -> scan. 3. Empty arguments -> scan; it is read-only and asks nothing. 4. fix is also auto-offered (not auto-run) whenever CRITICAL/HIGH findings exist, per Phase 6 — that offer is the outcome-changing AskUserQuestion, not a second resolution pass. 5. Prose that is not a mode/flag is still input: treat it as scope narrowing (e.g. "scan the api folder") if the skill supports it, otherwise ignore for routing and scan the full repo. Then print this block ONCE, before the first action: Labels are literal; values follow the conversation language. Print it at the end of Phase 1, once the file list is known, before Phase 2 spawns the scan agents. <phase name="1-setup"> Phase 1: Setup EXECUTE using Bash tool: The script resolves the repo root, creates the report dir under umask 077 + chmod 700, appends .claude/reports/ to .gitignore when nothing already ignores it, and writes the git-tracked file list to {DIR}/files.txt (chmod 600). It prints one line: DIR=.. REPO=.. TS=.. TOTAL=.. GITIGNORE=appended already-ignored. Why the .gitignore line. The report names where credentials live. .claude/ is ignored in some repos only by a personal global excludes file — in a consumer repo .claude/reports/ is committable, so the scan would publish its own findings. Report the GITIGNORE= value to the user. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills kochetkov-ma/secrets-scan