Skills secret-scanner
📦

secret-scanner

Content revision r1 Safe ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Detect Exposed Secrets in Code

Leaked credentials can give attackers access to cloud accounts, databases, and payment systems. This skill helps Claude, Codex, and Claude Code find likely secrets and produce clear remediation steps.

Supports: Claude Codex Code(CC)
🥉 77 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "secret-scanner" from https://skillstore.io/skills/curiouslearner-secret-scanner.md and its manifest at https://skillstore.io/api/skills/curiouslearner-secret-scanner/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/curiouslearner-secret-scanner.md Signed manifest GET /api/skills/curiouslearner-secret-scanner/manifest Signed lockfile GET /api/skills/curiouslearner-secret-scanner/lockfile

Test it

Using "secret-scanner". Scan this repository for committed credentials.

Expected outcome:

  • Critical: likely AWS access key in application configuration. Rotate it immediately and review cloud access logs.
  • High: GitHub token pattern in CI configuration. Replace it with a repository secret and reduce token scope.
  • Low: placeholder API key in documentation. No rotation required, but mark it as an example.

Using "secret-scanner". Create remediation steps for a leaked private key.

Expected outcome:

  • Revoke the key from all servers that trust it.
  • Generate a new key pair outside the repository.
  • Remove the key from current files and git history.
  • Audit server logs for unauthorized access during the exposure window.

Using "secret-scanner". Help prevent future leaks in this repo.

Expected outcome:

Add secret scanning to pre-commit hooks and CI. Commit only environment templates, ignore real secret files, and document required variables.

Security Audit

Safe
v10 • 7/9/2026 Open versioned report

The static analyzer flagged many sensitive strings, command examples, URLs, and environment variable references, but review shows they are part of a defensive secret scanning guide. No prompt injection, covert execution, credential collection, or unauthorized exfiltration intent was found in SKILL.md.

1
Files scanned
940
Lines analyzed
0
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (50)
SKILL.md:52-61 SKILL.md:61-64 SKILL.md:64-70 SKILL.md:70-73 SKILL.md:73-79 SKILL.md:79-84 SKILL.md:84-93 SKILL.md:93-96 SKILL.md:96-98 SKILL.md:98-101 SKILL.md:101-113 SKILL.md:113-116 SKILL.md:116-131 SKILL.md:131-134 SKILL.md:134-136 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-145 SKILL.md:145-153 SKILL.md:153-158 SKILL.md:158-175 SKILL.md:175-178 SKILL.md:178-193 SKILL.md:193-196 SKILL.md:196-211 SKILL.md:211-214 SKILL.md:214-226 SKILL.md:226-229 SKILL.md:229-241 SKILL.md:241-245 SKILL.md:245-280 SKILL.md:280-283 SKILL.md:283-310 SKILL.md:310-328 SKILL.md:328-331 SKILL.md:331-344 SKILL.md:344-358 SKILL.md:358-361 SKILL.md:361-380 SKILL.md:380-388 SKILL.md:388-401 SKILL.md:401-406 SKILL.md:406-424 SKILL.md:424-437 SKILL.md:437-450 SKILL.md:450-452 SKILL.md:452-472 SKILL.md:472-478 SKILL.md:478-493 SKILL.md:493-496
🌐 Network access (4)
SKILL.md:162 SKILL.md:186 SKILL.md:579 SKILL.md:694
📁 Filesystem access (3)
SKILL.md:426 SKILL.md:426 SKILL.md:426
🔑 Env variables (30)
SKILL.md:336 SKILL.md:477 SKILL.md:558 SKILL.md:795 SKILL.md:336 SKILL.md:477 SKILL.md:558 SKILL.md:795 SKILL.md:281 SKILL.md:282 SKILL.md:318 SKILL.md:319 SKILL.md:333 SKILL.md:336 SKILL.md:774 SKILL.md:775 SKILL.md:780 SKILL.md:495 SKILL.md:508 SKILL.md:510 SKILL.md:514 SKILL.md:847 SKILL.md:383 SKILL.md:387 SKILL.md:773 SKILL.md:779 SKILL.md:477 SKILL.md:614 SKILL.md:775 SKILL.md:776
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/curiouslearner-secret-scanner/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/curiouslearner-secret-scanner/security.svg)](https://skillstore.io/skills/curiouslearner-secret-scanner?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/curiouslearner-secret-scanner?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-secret-scanner/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/curiouslearner-secret-scanner.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

CuriousLearner. (2026). secret-scanner security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-secret-scanner/audits/10

BibTeX citation

@techreport{curiouslearner-curiouslearner-secret-scanner-2026, author = {CuriousLearner}, title = {secret-scanner security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/curiouslearner-secret-scanner/audits/10}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "secret-scanner security audit report (audit version 10)" version: "unspecified" type: report authors: - name: "CuriousLearner" date-released: "2026-07-09" url: "https://skillstore.io/skills/curiouslearner-secret-scanner/audits/10" identifiers: - type: other value: "skillstore:curiouslearner-secret-scanner:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
70
Community
74
Spec Compliance

What You Can Build

Pre-release repository scan

Check a repository before open source release or deployment and list secrets that need removal.

Developer pull request review

Review changed files for accidentally committed API keys, tokens, and private configuration values.

Incident response triage

Create a prioritized response plan after credentials are discovered in code or git history.

Try These Prompts

Scan the current project 
Use the secret scanner to inspect this repository for exposed credentials. Summarize any likely secrets and explain what I should do next.
Review staged changes 
Check my staged changes for secrets, tokens, private keys, and unsafe environment files. Separate real risks from placeholders.
Audit git history 
Scan the repository history for committed secrets. Report affected files, likely secret types, exposure scope, and cleanup recommendations.
Plan incident remediation 
A secret was committed and pushed. Build an incident response plan with rotation steps, access log checks, git history cleanup, and prevention controls.

Best Practices

  • Run secret scanning before commits, releases, and public repository changes.
  • Rotate any credential that was committed, even after it is removed from the current branch.
  • Use managed secret stores and commit only safe templates such as .env.example.

Avoid

  • Treating deleted secrets as safe while they remain in git history.
  • Committing real .env files, private keys, or production database URLs.
  • Running destructive cleanup commands without coordinating with repository collaborators.

Frequently Asked Questions

Does this skill rotate leaked secrets for me?
No. It recommends rotation steps, but you must revoke and replace secrets in the owning service.
Can it scan git history?
Yes. It includes guidance for history scanning with tools such as Gitleaks, TruffleHog, git-secrets, and detect-secrets.
Will it detect every secret?
No. Secret scanning is pattern based and can miss unusual formats or encrypted values.
How does it handle false positives?
It asks the assistant to review context and classify examples, placeholders, and test data separately from likely real secrets.
Is it safe for private repositories?
The skill is a local analysis guide. Review tool commands before running them, especially commands that scan remotes or rewrite history.
What should I do if a real secret is found?
Rotate the credential immediately, check access logs, remove it from files and history, and add prevention controls.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/CuriousLearner/devkit/tree/main/skills/secret-scanner

Ref

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

Maintenance freshness

7/18/2026

Usage

4 downloads · 196 views

File structure

📄 SKILL.md

More from CuriousLearner

View all

Related Skills

View all