Menu
Scan diff, tree, or branch history for committed credentials
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Verify, review, and push pending work as one milestone commit
Drive the current branch's PR to merge-ready: CI green and every review comment handled, ending with an outcome label
After owner accept: guard-checked squash-merge of the current branch's PR, base sync and branch cleanup
Open a pull request for the current branch against its target, using the repo template
Triage PR review comments: fix, discuss, or decline with reason - every thread answered
Cut a release: version, changelog, tag, and release object — policy-driven across trunk/gitflow and tag-only/full
| name | git-scan-secrets |
| description | Scan diff, tree, or branch history for committed credentials |
| argument-hint | [scope: diff|tree|history] |
| allowed-tools | Read, Grep, Glob, Bash |
Find credentials before they reach a remote; anything already pushed is an incident, not a cleanup. Default scope: the pending diff plus commits ahead of the target branch.
git diff --name-only + git diff --cached --name-only (+ git log -p <target>..HEAD for branch commits; history scope walks git log -p --all -- <paths>).-----BEGIN, AKIA[0-9A-Z]{16}, sk-, ghp_, xox[bp]-, AIza, eyJ[A-Za-z0-9_-]+\. (JWT), (password|secret|token|api[_-]?key)\s*[:=]\s*['"][^'"]+, connection strings with embedded credentials, .env-style files not covered by .gitignore.${VAR}, vault path - not a finding).file:line (or commit SHA for history hits), credential type, classification reasoning, redacted value..gitignore.dev-review-changes and the orchestrators pre-push; rotation itself belongs to the owner's secret store.