| name | secret-scan |
| description | Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident. |
| argument-hint | [--paths file1 file2] [--staged-only] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["secret scan","detect secrets","credential scan","api key check"] |
| chain | ["verify-fix"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix Secret Scan Skill
Use when
- Pre-commit: confirm no secrets in staged files (
--staged-only).
- Pre-push: scan diff vs
origin/HEAD for high-confidence leaks.
- Audit: full-repo scan for an exposed-secret incident.
- Producing a rotation list — which provider keys need to be revoked NOW.
- CI gate: block merge if any high-confidence secret detected.
Don't use for
- Vulnerability detection — use
/vulnetix:sast-scan or /vulnetix:sca-scan.
- Validating an already-fixed leak — use git filter-repo or BFG to remove from history.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Note binaries.git (required for --staged-only).
Step 2: Decide scope
--staged-only: git diff --cached --name-only for the file list.--paths: explicit list.- Default: changed files vs. main branch, fallback to whole repo.
Step 3: Run scan
vulnetix secrets --paths "$PATHS" -o json > .vulnetix/secrets.${TIMESTAMP}.json
Or via integrated scan:
vulnetix scan --evaluate-secrets --paths "$PATHS" -o json
Step 4: Render
Secret findings: N (high-confidence: M)
| Type | File:Line | Snippet (redacted) | Confidence |
For each finding, emit a redacted snippet (replace 60% of the secret with ). Never print the full secret.
