Individual skill

secrets-scanner

Narrowly scans code and config for hardcoded secrets, credentials, API keys, and tokens. Use before a commit/PR, or when auditing a codebase for accidentally-committed secrets.

skills/security/secrets-scanner/SKILL.md

Read pinned source

Source commit d0a9928d24afb7df0fad2f2f35f65d3938a6926a

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Aug 20, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

claude-code Repository topic
ai Repository topic
ai-agents Repository topic
ai-coding Repository topic
ai-skill Repository topic
ai-skill-enhancement Repository topic
ai-skills Repository topic
ai-skills-analysis Repository topic
ai-skills-fest Repository topic
ai-skills-manager Repository topic
engineering Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

README.mddoc · 1,436 bytes
SKILL.mdcore · 2,803 bytes
examples/example.mddoc · 2,186 bytes

Read excerpt


## Purpose

Find hardcoded secrets — API keys, passwords, tokens, private keys, connection strings with embedded credentials — sitting in code or config where they shouldn't be. Narrow and mechanical by design, unlike [Security Auditor](../../development/security-auditor/)'s broader vulnerability sweep.

## When to Use

- Before committing/opening a PR, especially after copy-pasting example code or config from elsewhere.
- Auditing an existing codebase for accidentally-committed secrets, e.g. before making a private repo public.
- The user specifically asks to check for "hardcoded secrets," "leaked credentials," or similar.

## What to Analyze

[Credential-related source omitted]
[Credential-related source omitted]