Menu
Scan code to detect secrets before commit. Checks tokens, API keys, credentials and sensitive data.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Audit naming quality (files, functions, types, variables, folders) without reading the code. Takes names as input and reports what Claude understands from each name alone. Judges three axes: Screaming Architecture (does the name reveal the domain?), Clean Code (full words, intention-revealing, no abbreviations), and Ubiquitous Language (vocabulary consistency across the codebase). Useful to validate that names self-document.
Extracts business rules from a module (backend + frontend) and produces three tables: Product view (business concepts), Backend dev view (type + source), Frontend dev view (type + source). Saves to docs/business-rules/.
Strategic DDD guide for this project (fullstack — backend + frontend share the same bounded contexts). Use to slice the domain into bounded contexts, define ubiquitous language, create a new business module, analyze boundaries between contexts. Tactical patterns follow Clean Architecture (see architecture-backend and architecture-frontend skills).
Runs a Big Picture Event Storming session on a bounded context or the entire codebase (backend + frontend). Discovers domain events, commands, entities, context boundaries, frontend projections (hooks, presenters, views). Produces a structured document in docs/ddd/.
Autonomous frontend feature implementation via spec-driven development. Orchestrates a frontend-planner and a frontend-implementer with architecture-frontend preloaded. Applies Humble Object pattern to views, MVVM structure with Presenter classes + Zod ViewModels, singleton registry DI. Consumes specs produced by /product-manager. For backend features, use /implement-feature instead.
Feature challenge and specification. Use to define a feature, write acceptance criteria, scope a ticket, produce INVEST specs with custom DSL in docs/specs/. Refuses vague scopes and forces clarification.
| name | security |
| description | Scan code to detect secrets before commit. Checks tokens, API keys, credentials and sensitive data. |
git commit or git push/security)| Pattern | Example | Regex |
|---|---|---|
| GitHub PAT | ghp_xxxx | gh[ps]_[a-zA-Z0-9]{36,} |
| GitHub OAuth | gho_xxxx | gho_[a-zA-Z0-9]{36,} |
| Linear API Key | lin_api_xxxx | lin_api_[a-zA-Z0-9]{20,} |
| OpenAI | sk-xxxx | sk-[a-zA-Z0-9]{32,} |
| Anthropic | sk-ant-xxxx | sk-ant-[a-zA-Z0-9-]{32,} |
| AWS Access Key | AKIA... | AKIA[0-9A-Z]{16} |
| Slack Token | xox[baprs]- | xox[baprs]-[a-zA-Z0-9-]+ |
| Pattern | Context |
|---|---|
password\s*=\s*["'][^"']+["'] | Hardcoded passwords |
secret\s*=\s*["'][^"']+["'] | Hardcoded secrets |
token\s*=\s*["'][^"']+["'] | Hardcoded tokens |
api[_-]?key\s*=\s*["'][^"']+["'] | Hardcoded API keys |
Bearer [a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+ | JWT tokens |
| File | Risk |
|---|---|
.env, .env.local | Environment variables with secrets |
*.pem, *.key | Private keys |
secrets.*, credentials.* | Secret files |
id_rsa, id_ed25519 | Private SSH keys |
git diff --cached --name-only
git diff --cached
Result:
SECURITY — Pre-commit scan
Files scanned: X
Secrets detected: Y
[If secrets found]
ALERT: Secrets detected!
File: src/config.ts
Line 42: token = "lin_api_..." (Linear API Key)
Action: Fix before committing.
Suggestion: Use an environment variable.
Scan all .ts, .json, .yml, .yaml, .env* files:
grep -rn -E "(ghp_|sk-|lin_api_|AKIA|password\s*=\s*[\"']|secret\s*=\s*[\"'])" --include="*.ts" --include="*.json" --include="*.yml" src/
Ignore if:
test_token, fake_key)xxxx, your-token-here).env.example with empty placeholdersSECURITY — Result
Status: OK / ALERT
Files scanned: X
Secrets detected: Y
[List: file, line, type]
[Correction suggestions]