secret-scan
Review Secret Scanning and Credential Remediation
Leaked credentials can remain accessible in repository history after deletion. This guide explains scanning workflows, credential rotation, and preventive hooks, but includes no executable scanner.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Review the Skillstore skill "secret-scan" from https://skillstore.io/skills/nexaiguy-secret-scan.md and its manifest at https://skillstore.io/api/skills/nexaiguy-secret-scan/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «secret-scan». Check whether this skill can scan my repository immediately.
Ожидаемый результат:
- This folder contains a guide, not an executable scanner.
- The described workflows cover files, staged changes, branch differences, history, archives, and text.
- No scan has run. A separately obtained and verified implementation is required.
Использование «secret-scan». A separate scanner found a redacted API key in an old commit. What should happen next?
Ожидаемый результат:
- Rotate or revoke the exposed credential first.
- Replace hardcoded values with environment-variable references and keep local secret files out of version control.
- Assess history cleanup with backups and repository-owner approval.
- Rescan the intended publication scope and verify preventive controls before publishing.
Аудит безопасности
БезопасноAll 20 static findings are false positives involving Markdown, defensive secret handling, or attribution links. No evidence found of credential exfiltration, reconnaissance, or prompt injection in SKILL.md. This guide excludes scanner scripts and hooks, so implementation safety and advertised protections cannot be verified.
Факторы риска
⚙️ Внешние команды (10)
🌐 Доступ к сети (2)
🔑 Переменные окружения (4)
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/nexaiguy-secret-scan/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/nexaiguy-secret-scan?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/nexaiguy-secret-scan?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nexaiguy-secret-scan/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/nexaiguy-secret-scan.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
nexaiguy. (2026). secret-scan security audit report (audit version 1) [Author version 1.1]. Skillstore. https://skillstore.io/skills/nexaiguy-secret-scan/audits/1Цитата BibTeX
@techreport{nexaiguy-nexaiguy-secret-scan-2026,
author = {nexaiguy},
title = {secret-scan security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/nexaiguy-secret-scan/audits/1},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "secret-scan security audit report (audit version 1)"
version: "1.1"
type: report
authors:
- name: "nexaiguy"
date-released: "2026-11-02"
url: "https://skillstore.io/skills/nexaiguy-secret-scan/audits/1"
identifiers:
- type: other
value: "skillstore:nexaiguy-secret-scan:audit:1"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: СреднийЧто вы можете построить
Prepare a repository for publication
Plan a credential review covering current files and reachable history before making a repository public.
Assess commit protection
Review the documented pre-commit and agent-hook workflows before obtaining and validating a separate implementation.
Coordinate credential remediation
Use the rotation-first sequence to plan recovery after discovering exposed keys or passwords.
Попробуйте эти промпты
Summarize this guide and identify which executable components are missing. Do not claim that a scan has run.
Plan a secret review for my repository and reachable history. Check scanner availability first, and do not install or run missing tools.
Review these redacted findings: [findings]. Prioritize credential rotation and configuration fixes. Do not request full secrets or execute history changes.
Assess a secret-prevention rollout for [repository]. Separate documented hook behavior from verified behavior, and require approval before configuration or history changes.
Лучшие практики
- Obtain and inspect the missing implementation before running commands or relying on protective hooks.
- Keep findings redacted and rotate exposed credentials before editing code or repository history.
- Back up repositories and obtain owner approval before history rewrites or mirror pushes.
Избегать
- Assuming this guide installs or enforces the advertised scanner and hooks.
- Treating deleted credentials or a clean pattern scan as proof that exposure is resolved.
- Pasting full credentials into chat or broadly suppressing findings without reviewing them.
Часто задаваемые вопросы
Does this folder include a working scanner?
Which AI tools can use this guide?
Does it check whether credentials are still active?
Are scans guaranteed to remain local?
Does the documented history scan cover everything?
How should false positives be handled?
Сведения для разработчиков
Автор
nexaiguyЛицензия
MIT
Версия автора
v1.1
Ревизия Skillstore
r1
Примечание о версии
Заявленная автором версия не соответствует SemVer.
Репозиторий
https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/secret-scanСсылка
3ddfdca559084abffbfdd188f2ba14b597dcfd9c
Актуальность поддержки
02.11.2026
Использование
0 загрузок · 0 просмотров
Структура файлов
📄 SKILL.md