Menu
Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Follow-up review that never trusts a commit message — always re-reads the actual diff before resolving a thread. Cites a real source for new issues, matching review-advanced.
Rigorous sequential-audit code review with a dedicated security block and cited pedagogical lessons. Customize for your project.
Review de suivi qui ne fait jamais confiance à un message de commit — relit toujours le diff réel avant de résoudre un thread. Cite une source réelle pour les nouveaux problèmes, comme review-advanced.
Code review rigoureuse à audits séquentiels, avec bloc sécurité dédié et leçons pédagogiques sourcées. À personnaliser pour votre projet.
Complete review of a documentation-focused MR/PR with 5 sequential audits oriented for documentation projects (markdown-quality, link-validity, terminology, freshness, examples-validity). No code-architecture audits, no React patterns, no SOLID. An orchestrator runs each audit one by one. Generates an .md report and posts it directly on the MR/PR. Direct mode with sourced lessons.
Follow-up review to verify corrections on a MR. Sequential execution to avoid memory spikes. Checks blocking issues, detects new problems, and posts a concise report on GitLab.
| name | security |
| description | Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data. |
Read .claude/roles/code-reviewer.md — adopt this profile and follow all its rules.
This skill activates:
git commit or git push/security)flux security-scan (full repo scan)| Pattern | Example | Regex |
|---|---|---|
| GitLab PAT | glpat-xxxx | glpat-[a-zA-Z0-9_-]{20,} |
| GitHub PAT | ghp_xxxx | gh[ps]_[a-zA-Z0-9]{36,} |
| GitHub OAuth | gho_xxxx | gho_[a-zA-Z0-9]{36,} |
| OpenAI | sk-xxxx | sk-[a-zA-Z0-9]{32,} |
| Anthropic | sk-ant-xxxx | sk-ant-[a-zA-Z0-9-]{32,} |
| AWS Access Key | AKIA... | AKIA[0-9A-Z]{16} |
| AWS Secret | - | [a-zA-Z0-9/+=]{40} (AWS context) |
| Slack Token | xox[baprs]- | xox[baprs]-[a-zA-Z0-9-]+ |
| Discord Token | - | [MN][a-zA-Z0-9]{23,}\.[a-zA-Z0-9-_]{6}\.[a-zA-Z0-9-_]{27} |
| Pattern | Context |
|---|---|
password\s*=\s*["'][^"']+["'] | Hardcoded passwords |
secret\s*=\s*["'][^"']+["'] | Hardcoded secrets |
token\s*=\s*["'][^"']+["'] | Hardcoded tokens |
api[_-]?key\s*=\s*["'][^"']+["'] | Hardcoded API keys |
Bearer [a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+ | JWT tokens |
| File | Risk |
|---|---|
.env | Environment variables (often secrets) |
*.pem, *.key | Private keys |
secrets.*, credentials.* | Secret files |
config.toml with [secrets] section | Config with embedded secrets |
id_rsa, id_ed25519 | Private SSH keys |
SECURITY - Pre-commit Scan
Analyzing staged diff...
Result:
- Files scanned: X
- Secrets detected: Y
[If secrets found]
WARNING: Secrets detected!
File: src/config.ts
Line 42: token = "glpat-..." (GitLab PAT)
Action: Fix before committing.
Suggestions:
- Use an environment variable
- Move to a secure configuration file
SECURITY - Full Scan
Scanning entire repository...
Result:
- Files scanned: X
- Files ignored (.gitignore): Y
- Secrets detected: Z
[List of files with secrets]
git diff --cached --name-only # List of staged files
git diff --cached # Diff content
# Example with grep (the skill uses more advanced tools)
git diff --cached | grep -E "(glpat-|ghp_|sk-|password\s*=)"
Ignore if:
test_token, fake_key)xxxx or your-token-here)This skill applies the security rule:
Absolute rule: Never store tokens, API keys, or secrets in plain text in code or versioned files.
The scan produces a report with: