security-secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

Jump to install

Repository: IgorWarzocha/Opencode-Workflows
Last source activity: January 12, 2026 at 18:16
Detected SKILL.md language: English
Stars: 123
Forks: 12

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-secrets

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

# Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

security-secrets

Install options

Review the source files

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

security-secrets

Source facts

Install options

Review the source files

More from this repository

More from this repository

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format