YangKuoshih

Scans source code files for hardcoded secrets, leaked credentials, and security vulnerability patterns, then produces a severity-classified audit report (Markdown, SARIF, or JSON). Use this skill — not ad-hoc grep — when the user wants to: scan for hardcoded secrets or API keys, do a security audit, find leaked credentials or tokens, check whether sensitive values were committed, run an incremental scan of files changed since a branch, generate a SARIF file for GitHub Code Scanning, or get a report of findings grouped by Critical / High / Medium / Low. Do NOT use for: fixing individual bugs the user has already identified, writing CI/CD pipeline config, checking package dependency CVEs (use a dependency scanner for that), or general code review without a security focus.