スキル secret-scan
📦
secret-scan
v1.1 コンテンツリビジョン r1 安全 ⚙️ 外部コマンド🌐 ネットワークアクセス🔑 環境変数
Review Secret Scanning and Credential Remediation
Leaked credentials can remain accessible in repository history after deletion. This guide explains scanning workflows, credential rotation, and preventive hooks, but includes no executable scanner.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "secret-scan" from https://skillstore.io/skills/nexaiguy-secret-scan.md and its manifest at https://skillstore.io/api/skills/nexaiguy-secret-scan/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「secret-scan」を使用しています。 Check whether this skill can scan my repository immediately.
期待される結果:
- This folder contains a guide, not an executable scanner.
- The described workflows cover files, staged changes, branch differences, history, archives, and text.
- No scan has run. A separately obtained and verified implementation is required.
「secret-scan」を使用しています。 A separate scanner found a redacted API key in an old commit. What should happen next?
期待される結果:
- Rotate or revoke the exposed credential first.
- Replace hardcoded values with environment-variable references and keep local secret files out of version control.
- Assess history cleanup with backups and repository-owner approval.
- Rescan the intended publication scope and verify preventive controls before publishing.
セキュリティ監査
安全v1 • 2026/11/2 バージョン別レポートを開く
All 20 static findings are false positives involving Markdown, defensive secret handling, or attribution links. No evidence found of credential exfiltration, reconnaissance, or prompt injection in SKILL.md. This guide excludes scanner scripts and hooks, so implementation safety and advertised protections cannot be verified.
1
スキャンされたファイル
109
解析済み行数
0
レビュー項目
0
誤検知を無視
リスク要因
⚙️ 外部コマンド (10)
🌐 ネットワークアクセス (2)
🔑 環境変数 (4)
最新の完了済み静的・セマンティック監査では、確認済みのセキュリティ検出事項は見つかりませんでした。これは、スキルに副作用がないことを証明するものではありません。
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/nexaiguy-secret-scan/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/nexaiguy-secret-scan?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/nexaiguy-secret-scan?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nexaiguy-secret-scan/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/nexaiguy-secret-scan.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
nexaiguy. (2026). secret-scan security audit report (audit version 1) [Author version 1.1]. Skillstore. https://skillstore.io/skills/nexaiguy-secret-scan/audits/1BibTeX形式の引用
@techreport{nexaiguy-nexaiguy-secret-scan-2026,
author = {nexaiguy},
title = {secret-scan security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/nexaiguy-secret-scan/audits/1},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "secret-scan security audit report (audit version 1)"
version: "1.1"
type: report
authors:
- name: "nexaiguy"
date-released: "2026-11-02"
url: "https://skillstore.io/skills/nexaiguy-secret-scan/audits/1"
identifiers:
- type: other
value: "skillstore:nexaiguy-secret-scan:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Prepare a repository for publication
Plan a credential review covering current files and reachable history before making a repository public.
Assess commit protection
Review the documented pre-commit and agent-hook workflows before obtaining and validating a separate implementation.
Coordinate credential remediation
Use the rotation-first sequence to plan recovery after discovering exposed keys or passwords.
これらのプロンプトを試す
Understand the guide
Summarize this guide and identify which executable components are missing. Do not claim that a scan has run.
Plan a repository review
Plan a secret review for my repository and reachable history. Check scanner availability first, and do not install or run missing tools.
Interpret redacted findings
Review these redacted findings: [findings]. Prioritize credential rotation and configuration fixes. Do not request full secrets or execute history changes.
Assess preventive controls
Assess a secret-prevention rollout for [repository]. Separate documented hook behavior from verified behavior, and require approval before configuration or history changes.
ベストプラクティス
- Obtain and inspect the missing implementation before running commands or relying on protective hooks.
- Keep findings redacted and rotate exposed credentials before editing code or repository history.
- Back up repositories and obtain owner approval before history rewrites or mirror pushes.
回避
- Assuming this guide installs or enforces the advertised scanner and hooks.
- Treating deleted credentials or a clean pattern scan as proof that exposure is resolved.
- Pasting full credentials into chat or broadly suppressing findings without reviewing them.
よくある質問
Does this folder include a working scanner?
No. It contains SKILL.md only. Scanner scripts, hook implementations, extension source, and templates are explicitly excluded.
Which AI tools can use this guide?
Claude, Codex, and Claude Code can use the guidance. The documented executable workflow requires Python 3.8 or newer and Git for repository modes.
Does it check whether credentials are still active?
The described scanner does not contact providers to validate credentials. Treat credible exposure as requiring rotation.
Are scans guaranteed to remain local?
The guide describes a local, network-free scanner. That claim cannot be verified because the implementation is not included.
Does the documented history scan cover everything?
No. It covers commits reachable from references, excluding stashes and the reflog. Other documented exclusions include binaries and files over 2 MB.
How should false positives be handled?
The guide describes line allowances, fingerprint ignores, and baselines. Review each exception, and verify support in the separately obtained implementation.