secret-scan
Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.
Source facts
- Repository
- Archive228/loopkit
- Last source activity
- June 29, 2026 at 21:52
- Detected SKILL.md language
- English
- Stars
- 757
- Forks
- 124
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- secret-scan
- description
- Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.
- when_to_use
- before commit, files with API keys, .env handling, config, connection strings
# Secret Scan
Grep the diff for: `api[_-]?key`, `secret`, `token`, `password`, `BEGIN PRIVATE KEY`, `AKIA[0-9A-Z]{16}`, `sk-`, `ghp_`, bearer values, and long base64/hex blobs.
For each hit: is it a real secret or a placeholder? Real secrets:
1. Must move to env / a secrets manager — never the repo.
2. If already committed, it is COMPROMISED. Rotate it, don't just delete the line.
3. Add the pattern to `.gitignore` / a pre-commit secret scanner.
Output: file:line of every real secret + the rotation step. A deleted secret in git history is still leaked.
View on GitHub