security-secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

Zur Installation springen

Repository: jal-co/jalco-opencode
Letzte Quellaktivität: 26. Januar 2026 um 05:26
Erkannte Sprache von SKILL.md: Englisch
Sterne: 7
Forks: 2

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/jal-co/jalco-opencode --skill security-secrets

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

3 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

# Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

security-secrets

Installationsoptionen

Quelldateien prüfen

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

security-secrets

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format