| name | secret-guard |
| description | Detect secrets and credentials before they leak into git. Use this skill when: (1) About to commit code — scan staged files for API keys, tokens, passwords, private keys (2) User mentions secrets, credentials, API keys, tokens, .env, or sensitive data (3) User asks to "check secrets", "audit security", "review for leaks" (4) User asks about .gitignore coverage for sensitive files (5) Before creating a PR or push — final safety check Trigger phrases: "check for secrets", "scan for leaks", "is this safe to commit", "audit .gitignore", "any credentials exposed", "secrets", "confidential".
|
Secret Guard
Prevent secret leakage via git. Cross-platform, Python stdlib only (no pip install).
Before running any bundled script, resolve <skill-dir> as the directory containing this SKILL.md. Do not assume the current working directory is the skill folder.
For staged, tracked, and gitignore modes, run the command with the current working directory set to the target git repository you want to audit.
Pre-Commit Check (DEFAULT)
Run before ANY commit that touches config, env, auth, or infra files:
python "<skill-dir>/scripts/scan_secrets.py" staged
Exit 0 = clean, exit 1 = findings. If findings exist, do NOT commit — remove or move secrets to env vars first.
Full Repo Audit
Scan all tracked files:
python "<skill-dir>/scripts/scan_secrets.py" tracked
Gitignore Coverage Audit
Verify .gitignore covers common sensitive file patterns:
python "<skill-dir>/scripts/scan_secrets.py" gitignore
Reports which patterns (.env, *.pem, *.key, credentials.json, etc.) are NOT covered.
When User Mentions Secrets/Credentials
If the user discusses API keys, tokens, passwords, or sensitive config:
- Resolve
<skill-dir> from this SKILL.md, then run python "<skill-dir>/scripts/scan_secrets.py" staged
- Run
python "<skill-dir>/scripts/scan_secrets.py" gitignore to verify .gitignore coverage
- If findings: list them clearly with remediation steps
- If clean: confirm no secrets detected
Remediation Workflow
When secrets are found:
- Unstage the file:
git reset HEAD <file>
- Move secret to env var: replace hardcoded value with
os.environ["KEY"] / process.env.KEY etc.
- Add to .gitignore if the file is inherently sensitive (.env, *.pem, credentials.json)
- If already committed: warn the user that the secret is in git history and suggest
git filter-repo or rotating the credential
- Re-scan:
python "<skill-dir>/scripts/scan_secrets.py" staged
What Gets Detected
- Sensitive files: .env, *.pem, *.key, *.p12, credentials.json, id_rsa, kubeconfig, etc.
- Content patterns: AWS keys (AKIA...), GitHub tokens (ghp_/github_pat_), GCP API keys, Stripe keys, Slack tokens, private key blocks (-----BEGIN ... PRIVATE KEY-----), JWT tokens, database connection strings, password/secret variable assignments, and 30+ provider-specific patterns
- Gitignore gaps: checks whether common sensitive file types are covered by .gitignore rules
For the full pattern catalog, see references/patterns.md.
