security-secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

Ir a la instalación

Repositorio: IgorWarzocha/Opencode-Workflows
Última actividad en el origen: 12 de enero de 2026 a las 18:16
Idioma detectado de SKILL.md: inglés
Estrellas: 123
Forks: 12

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-secrets

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

3 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

command-creator

Create custom /slash commands for repetitive tasks. Use proactively for command creation, prompt automation, or workflow shortcuts. Examples: - user: "Make a /test command that runs pytest" → create command in opencode.json, set prompt to run tests with bash tool - user: "Add a /review command for PRs" → design prompt to fetch diff, analyze changes, generate review comments - user: "Automate this repetitive task" → identify pattern, create slash command with parameterized prompt - user: "Make a /deploy command" → design workflow (build, test, deploy), encode in command prompt

2026-01-27

agent-navigation-sop

Generate AGENTS.md for AI agent navigation. Covers build/test commands, coding conventions, task routing, and codebase structure. Use proactively during /init workflow or when creating agent-readable repository documentation. Examples: - user: "/init" → full AI navigation AGENTS.md + skill recommendations - user: "/init basic" → minimal AGENTS.md structure only - user: "Create AGENTS.md for this repo" → assess complexity, generate navigation doc - user: "Document codebase for AI agents" → structured AGENTS.md with task routing

2026-01-27

user-onboarding-sop

Generate AGENTS.md for end-user assistance. Covers setup, installation, running, and troubleshooting. Use proactively when user asks for "getting started" help or during /init user workflow. Examples: - user: "/init user" → user assistance AGENTS.md with official docs - user: "Create getting started guide" → installation + setup + troubleshooting - user: "Document how to use this repo" → user-focused AGENTS.md - user: "Help users run this software" → setup, prerequisites, usage patterns

2026-01-27

Ver todos los de este repositorio

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

# Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

security-secrets

Opciones de instalación

Revisa los archivos de origen

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

security-secrets

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

Más de este repositorio

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format