| name | secret-scanner |
| description | Deep-scans every file in a repository for hardcoded credentials, API keys,
tokens, and passwords using a library of known credential patterns.
Reports findings by severity — CRITICAL for active credentials,
ELEVATED for suspicious patterns. Masks actual credential values in output.
Never outputs the actual secret — only its location and classification.
|
| allowed-tools | read-file write-file list-directory run-grep-scan |
Skill: secret-scanner
Objective
Find every hardcoded credential, token, and secret in the target repository.
MASK all actual credential values in output. Report location and type, never the value.
Scan Targets
CRITICAL Patterns (immediate rotation required)
- Hardcoded passwords:
password = "...", passwd = "...", pwd = "..."
- API keys:
api_key = "...", apikey = "..."
- Generic secrets:
secret = "...", SECRET_KEY = "..."
- AWS Access Keys: pattern
AKIA[A-Z0-9]{16}
- GitHub tokens: pattern
ghp_[a-zA-Z0-9]{36}
- Stripe keys: pattern
sk_live_[a-zA-Z0-9]+
- Private key headers:
BEGIN RSA PRIVATE KEY, BEGIN EC PRIVATE KEY
ELEVATED Patterns (investigate)
- JWT secrets:
jwt_secret, JWT_SECRET
- Database connection strings containing credentials
.env files committed to the repository*.pem, *.p12, *.pfx, *.key files
Output Format
Produce a Secret Scan Report with this structure:
SECRET-SCAN REPORT
==================
Target: [directory]
Files Scanned: [N]
Secrets Found: [N]
CRITICAL FINDINGS:
[SEC-001] TYPE: Hardcoded API Key
File: src/auth.py, Line: 12
Pattern matched: api_key = "sk_live_[REDACTED]"
Action required: ROTATE IMMEDIATELY. Assume this key is compromised.
Causal root: No pre-commit secret scanning configured. No engineer review caught this.
ELEVATED FINDINGS:
[SEC-002] TYPE: .env file committed
File: .env, Line: 1
Pattern matched: .env file present in repository
Action required: Remove from git history (git filter-repo), add to .gitignore.
SYSTEMIC VERDICT:
[State whether findings indicate a systemic secret management failure or an isolated incident]
MANDATORY: End every finding with a "Causal root:" that identifies the systemic process failure, never the individual developer.
